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14 JtA-s 

This  investigation  reviewed  the  effectiveness  of  the 
Internal  Control  Review  (ICR)  program.  The  review 
consisted  consisted  of  two  parts.  First,  a  literature 
review  revealed  strong  feelings  among  field  personnel  that 
the  ICR  program  needs  modification.  Second,  a  pilot 
interview  was  administered  to  31  Cost  Analysis 
practitioners.  At  least  one  representative  was  selected 
from  each  major  air  command,  one  Separate  Operating  Agency 
(SOA),  and  two  recent  overseas  returnees.  Participants 
were  polled  about  their  opinions,  about  strengths  or 
weaknesses  within  the  program,  and  about  specific 
suggestions  for  improvement. 

Statistical  analyses  were  completed  using  results  from 
the  Statistical  Package  for  Social  Sciences  (SPSS)  pro¬ 
grams.  Analysis  of  results  indicated  that  the  ICR  program 
is  misunderstood.  Program  guidance  and  year-end  certifica¬ 
tion  require  simplification.  Greater  emphasis  should  be 
placed  on  invoking  and  refining  current  internal  management 
controls.  The  most  frequently  suggested  method  was  merging 
the  Air  Force  self -inspection  program  with  the  ICR  program. 
Recommendations  included  increased  training  to  forestall 
misunderstanding,  streamlining  guidance,  strengthening  the 
self -inspection  program,  and  a  cost/benefit  analysis  of  the 
ICR  program.  ( 
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AIR  FORCE  INTERNAL  CONTROL  SYSTEMS: 

A  PROPOSAL  FOR  IMPROVEMENT 

I.  INTRODUCTION 

General  Issue 

Congress  and  the  American  public  are  demanding  more 
efficiency  in  handling  costly  government  resources  and  less 
evidence  of  fraud,  waste,  abuse,  misuse,  and  misappropria¬ 
tion  of  these  resources  (63:1;  53:1). 

In  1977,  former  Comptroller  of  the  United  States, 

Elmer  B.  Staats  stated: 

Today  government  at  all  levels  is  beset  with  financial 
problems;  one  need  only  read  the  papers  [sic].  Our 
larger  cities  have  serious  financial  problems.  The 
federal  government  and  state  governments,  too,  are  feel 
ing  the  pinch  of  steadily  rising  costs  accompanied  by 
widespread  taxpayer  opposition  to  tax  increases  [33:26] 

Today’s  newspapers  frequently  discuss  Gramm-Rudman- 

Hol lings  decreed  budget  cuts  and  limitations.  However,  the 

idea  of  controlling  resources  did  not  originate  within  the 

pages  of  the  Gramm-Rudman-Hollings  bill.  On  10  June  1921, 

the  67th  Congress  passed  Senate  Bill  1064  which  became  the 

Budget  and  Accounting  Act  of  1921.  The  Act  created  the 

Bureau  of  the  Budget  (BOB)  within  the  Treasury  Department. 

Two  new  positions  were  created,  those  of  Comptroller 

General  of  the  United  States  and  the  Assistant  Comptroller 

General.  They  wou],d  head  the  General  Accounting  Office 

(GAO),  the  new  legislative  branch  agency  created  by  the  act 

(1:27-8). 
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The  1921  Act  was  a  move  toward  improving  control  over 
federal,  and  therefore  public,  funds  through  creation  of  a 
separate  auditing  agency,  the  GAO.  The  Act  separated  the 
duties  of  the  Division  of  Bookkeeping  and  Warrants  between 
the  Treasury  Department  and  the  newly  created  GAO  (1:28). 

Then  in  September  of  1950,  the  Budget  and  Accounting 
Procedures  Act  (Public  Law  784)  was  passed.  Its  major 
emphasis,  internal  control,  was  contained  in  Part  II  of  the 
act,  Accounting  and  Auditing.  It  is  therefore  widely  known 
as  the  Accounting  and  Auditing  Act  of  1950  (1:29).  The  Act 
required  establishment  and  maintenance  of  adequate  systems 
of  accounting  and  internal  controls  (47:3)  and  "placed 
responsibility  on  each  agency  head"  for  those  actions 
(1:29). 

Over  20  years  later,  the  weak,  unenforceable,  or  non¬ 
existent  federal  controls  became  the  headlines  of  the 
seventies.  "Fraud,  waste,  and  abuse"  became  household 
words.  Two  Inspector  General  Acts  were  passed,  in  1976  and 
1978,  to  establish  the  position  of  Inspector  General  (IG) 
in  the  major  executive  agencies  (1:29).  More  in  line  with 
resource  management  the  Acts  "require  semi-annual  reports 
on  discovered  fraud,  waste,  and  abuse"  (1:29).  These  Acts, 
however,  lacked  "teeth,"  there  were  no  enforcement 
provisions  and  they  further  lacked  measures  to  "safeguard 
existing  and  future  resources"  (1:29). 
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"Hotlines"  were  created  in  the  j.ate  seventies,  many  of 
which  still  exist  today  (99:1;  56:12).  They  increased 
public  awareness  of  the  problem,  but  they  were  after-the- 
fact  and  not  preventive  measures  (1:30).  Fraud,  waste,  and 
abuse  programs  abound  throughout  DOD.  The  Air  Force  has  a 
special  regulation  which  mandates  the  "Hotline”  (31:15). 

In  1981,  a  Comptroller  General  report  stated  that 
"Good  internal  controls  are  the  most  effective  deterrent  to 
mismanagement  and  misuse  of  funds"  (36:26)  and  the  shift 
from  detection  to  prevention  began  (99:1). 

Congress  enacted  the  Federal  Managers’  Financial  Inte¬ 
grity  Act  of  1982,  31  U.S.C.  3512  (Public  Law  97-255)  for 
the  purpose  of  strengthening  internal  management  controls 
and  administrative  controls  (40: i)  and  to  provide 
"effective  control  over  and  the  accountability  for  all 
funds,  property,  and  other  assets"  over  which  an  agency  has 
responsibility  (43:1).  This  Act  amended  the  1950  Act  to 
include  an  annual  evaluation  and  executive  agency  report  of 
agency  internal  control  status  to  the  President  and 
Congress  (47:3;  76:81). 

The  Bureau  of  the  Budget  (BOB)  was  transferred  from 
the  Treasury  Department  into  the  newly  created  Executive 
Office  of  the  President.  This  allowed  financial  orienta¬ 
tion  toward  management  as  well  as  control.  Management 
concerns  increased  as  government  services  became  more 
complex  during  the  1960’s  (58:5).  Then,  in  1970,  the  BOB 


was  renamed  the  Office  of  Management  and  Budget  (OMB)  as  it 
is  known  today.  The  new  OMB  orientation  was  directed 
toward  both  management  and  planning  (58:5).  Shortly 
thereafter,  Office  of  Management  and  Budget  (OMB)  Circular 
A- 34  required  the  Director  of  OMB  to  approve  agency  fund 
control  systems  (47:3). 

Within  the  Air  Force,  OMB  Circular  A-123,  was  included 
as  an  attachment  to  Air  Force  Regulation  170-22,  10 
December  1982  (revised  16  August  1983).  The  circular 
outlines  a  program  of  Internal  Control  Reviews  (ICRs)  to 
reevaluate  the  existing  resource  controls  and  identify  any 
significant  weaknesses  in  the  areas  reviewed  (32:1). 

Vulnerability  assessments  were  required  of  all  execu¬ 
tive  agencies  to  "determine  areas  susceptible  to  loss  or 
unauthorized  use  of  resources,  errors  in  reports  and  infor¬ 
mation,  illegal  or  unethical  acts,  and/or  adverse  or  un¬ 
favorable  public  opinion"  (1:33). 

Background 

In  the  original  OMB  A-123  Circular,  Internal  Controls 
were  defined  as: 

the  plan  of  organization  and  all  of  the  methods  and 
measures  adopted  within  an  agency  to  safeguard  its  re¬ 
sources,  assure  the  accuracy  and  reliability  of  its 
information,  assure  adherence  to  applicable  laws,  regu 
lations  and  policies,  and  promote  operational  economy 
and  efficiency  [75:1]. 

i 

Internal  Controls  are  defined  by  the  revised  OMB 
Circular  A-123  as: 
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the  plan  of  organization  and  methods  and  procedures 
adopted  by  management  to  provide  reasonable  assurance 
that  obligations  and  costs  are  in  compliance  with  appli¬ 
cable  law;  funds,  property,  and  other  assets  are  safe¬ 
guarded  against  waste,  loss,  unauthorized  use,  or  mis¬ 
appropriation;  and  revenues  and  expenditures  applicable 
to  agency  operations  are  properly  recorded  and  accounted 
for  to  permit  the  preparation  of  accounts  and  reliable 
financial  and  statistical  reports  and  to  maintain 
accountability  over  the  assets  [75:2]. 

The  reader  should  note  that  this  definition  is 
narrower  than  that  of  the  first  OMB  Circular.  All  refer¬ 
ences  to  administrative  controls,  adherence  to  applicable 
laws,  regulations,  or  policies,  and  the  promoting  of  opera¬ 
tional  economy  and  efficiency  have  been  deleted  bringing 
the  definition  into  closer  alignment  with  the  Federal 
Managers’  Financial  Integrity  Act  which  provides  for 
management  accountability  and  integrity  in  the  use  of 
public  funds  (76:22,24). 

Similar  definitions  exist  in  Army  and  Navy  publica¬ 
tions,  within  the  GAO  Standards,  and  Department  of  Defense 
(DOD)  Directive  7040.6  (1:19).  FY84  Air  Force  guidance 
further  simplified  this  definition.  An  Internal  Control 
Review  (ICR)  is: 

a  detailed  examination  of  a  program  or  administrative 
function  to  determine:  (1)  if  adequate  controls 
against  fraud,  waste,  and  abuse  exist,  and  (2)  if 
these  controls  are  working  [94:1]. 

In  simple  language,  "internal  control  is  more 


generally  defined  as  all  the  methods  by  which  an  organiza- 

i 

tion  governs  its  activities  to  accomplish  its  defined 
purpose"  (1:19). 
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Figure  1 

Adapted  from  Oppe':74  (76:74). 

Department  of  Defense  (DOD)  Directive  5010.38,  (re¬ 
vised  and  renumbered  as  of  16  July  1984  from  7040.6)  calls 
for  managers  at  all  levels  to  be  responsible  for  internal 
controls.  It  states  that  the  controls  should  be  in  effect 
"across  the  board  in  every  organization  within  each  DOD 
component"  (32:1).  This  directive  stresses  the  need  for 


adequate  internal  control  to  efficiently  and  effectively 
manage  resources,  stating  that  this  control  is  the 
"foundation  for  integrity  in  the  management  system"  (27*.  1). 

Guidelines  and  standards  for  internal  controls  are 
prescribed  by  the  Comptroller  General  of  the  United  States 
in  the  revised  OMB  A-123.  Included  are  reasonable  assur¬ 
ance,  positive  and  supportive  attitudes  toward  the  internal 
controls,  and  defined  control  objectives  (47:4). 

Other  standards  state  that  managers  and  employees  are 
to  have  integrity,  and  maintain  a  level  of  competence 
to  accomplish  their  duties  and  understand  the 
importance  of  internal  controls  [47:4]. 

All  of  the  standards  must  be  attainable  as  well  as 
functional  (47:4).  Other  specific  standards  cover  transac¬ 
tion  recording,  separation  of  duties,  resource  account¬ 
ability,  supervision,  etc.  (see  Appendix  B).  Since  there 
always  seem  to  be  people  who  take  advantage  of  a  system’s 
"loopholes"  for  their  own  benefit,  so  called  "white  collar 
crime,"  a  sound  system  of  internal  controls  is  needed. 

"Reasonable  assurance"  as  to  how  well  an  agency  is 
doing  meeting  legal  requirements  of  the  Act  must  be 
certified  annually  by  the  head  of  an  agency  (47:4).  A 
"material  weakness"  is  a  situation  where  the  procedures  as 
designed  or  the  degree  of  operational  compliance  does  not 
provide  this  "reasonable  assurance"  to  meet  the  objectives 
of  internal  control  stated  by  the  1982  Act  (76:82). 

i 

It  then  becomes  a  question  of  how  much  fraud,  waste, 
or  abuse  is  acceptable,  and  how  much  will  it  cost  to 
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prevent  or  deter  those  violations.  In  The  Egyptian  by  Mika 
Waltari,  a  courtier  seeks  to  curry  favor  with  the  Pharaoh’s 
physician,  Sinuhe.  This  courtier  secretively  warns  Sinuhe 
that  his  servant-slave  is  skimming  funds  from  his  transac¬ 
tions.  Sinuhe,  aware  of  the  thefts,  explains  that  his 
servant  has  made  him  a  rich  man,  "He  is  a  thief  and,  as 
such,  is  an  excellent  financial  advisor.  He  only  takes  a 
reasonable  amount  and  surely  this  is  worth  the  saving  of  my 
time  and  well-being"  (59:6-7).  Although  the  government  may 
not  be  so  cavalier,  the  cost  of  performing,  documenting, 
and  later  auditing,  an  ICR  must  be  weighed  against  the 
benefits,  as  it  is  a  long,  involved,  and  potentially 
expensive  process. 

The  ICR  process  described  in  OMB  guidelines  represents 
"difficult  and  time-consuming  tasks  for  managers,"  it  is  a 
detailed  examination  of  a  set  of  internal  management  con¬ 
trols  (37:3).  Further,  since  the  ICR  program  requires 
segmentation  for  better  management,  the  Air  Force  chose  to 
create  these  segments  along  functional  lines.  Each  segment 
must  be  assessed  as  to  fraud,  waste,  and  abuse  vulner¬ 
ability  (see  Appendix  A),  and  ICRs  must  be  performed  on 
moderately  or  highly  vulnerable  functions  (98:1). 

For  internal  control  systems  to  function  properly 
there  are  two  factors  that  are  considered  critical:  goal 


congruence  and  linkage  (1:24). 
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A  control  system  should  be  designated  so  that  actions 
people  take  in  their  self-interest  are  also  in  the 
best  interest  of  the  organization.  This  requires 
recognition  of  the  fact  that  individuals  act  in  their 
own  interest  and  their  individual  goals  are  not 
necessarily  those  of  the  organizations ...  controls 
need  to  be  linked  to  objectives  in  that  the  controls 
are  established  which  provide  reasonable  assurance 
that  the  objectives  of  the  control  system  will  be 
accomplished  [1:24]. 

Two  other  points  should  be  made  about  any  system  of 
internal  controls.  "First,  they  should  be  cost  beneficial" 
(1:24;  76:67),  benefits  should  exceed  the  cost  of 
implementing  the  system,  and  second,  emphasis  should  be 
placed  on  better  controls  not  on  more  controls. 

The  cost-benefit  relationship  must  be  weighed  and  both 
indirect  and  direct  costs  taken  into  account.  Often  the 
non-monetary  impact  of  the  lack  of  internal  controls  escapes 
the  casual  observer.  Not  only  does  the  Air  Force  face  loss 
of  public  confidence  in  its  ability  to  do  business  prop¬ 
erly,  but  there  could  be  a  serious  impact  on  mission  readi¬ 
ness.  Though  difficult  to  measure,  consider  the  loss  of 
pilferable  items  from  mobility  bags.  On  arrival  at  a 
deployment  area,  the  loss  of  items  that  seemed  minor  at 
home  could  reduce  mission  capability  seriously  (93:8).  The 
very  old  parable,  "For  want  of  a  nail,  a  shoe  was  lost;  for 
want  of  a  shoe,  the  horse  was  lost;  for  want  of  a  horse, 
the  battle  was  lost;  for  want  of  the  battle,  the  war  was 
lost,"  does  indeed  summarize  the  results  of  inadequate 
resources  that  may  appear  to  be  trivial  (60:10). 


Development  of  the  program  in  the  Air  Force  began 
before  AFR  170-22  was  published.  Internal  Control  Reviews 
of  highly  vulnerable  areas  were  directed  after  initial 
assessment  of  Air  Force-wide  vulnerability  to  fraud,  waste, 
and  abuse.  Vulnerability  assessments  by  the  Secretary  of 
the  Air  Force,  Financial  Management  Board  (SAF/FMB),  HQ 
USAF,  and  major  command  (MAJCOM)  officials  led  to  "judgmen¬ 
tal  ranking  of  231  subjects"  (3:1).  Eighty-two  of  the 
topics  were  considered  more  vulnerable  and  were  assigned 
for  internal  control  reviews  during  Fiscal  Year  (FY)  83. 

Most  MAJCOM  commanders  have  designated  their  command 
comptroller  as  responsible  for  developing  the  command  ICR 
plan  to  meet  the  objectives  of  the  Air  Force  program,  as 
suggested  by  the  Air  Force  (50).  Similar  to  other  MAJCOMs, 
Air  Force  Systems  Command: 

functional  managers  assigned  to  the  headquarters  staff 
were  selected  by  the  various  Deputy  Chiefs  of  Staff, 
to  identify  internal  control  systems  for  review, 
select  locations  at  which  reviews  would  be  accomp¬ 
lished,  establish  a  schedule  for  completion  of  field 
work  and  provide  guidance  to  base-level  functional 
managers  who  would  actually  accomplish  the 
reviews  [48:6]. 

In  FY83,  the  first  year  of  implementation,  most  DOD 
agencies  encountered  similar  problems.  Implementation  led 
to  wide  variance  in  quality  and  documentation  (38:3), 
inadequate  or  unclear  guidance  (38:12;  97:1),  short  lead 


time,  lack  of  training,  and  "widespread  confusion  as  to 

i 

what  [was]  actually  required"  (48:7).  Base/wing 
comptroller  (AC)  divisions,  specifically  the  Cost  & 
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Management  Analysis  (ACM)  branches,  were  heavily  taxed, 
along  with  MAJCOM/ACs,  to  expend  over  293,000  manhours  on 
the  ICR  program  (98:1).  Analysts  accomplished  “4,400 
detailed  internal  control  reviews"  which  reported  only  four 
material  weaknesses  (3:i). 

The  FY83  program  led  to  new  instructions  from  HQ 
USAF/AC  in  January  1984.  These  instructions  explained  the 
documentation  requirements  more  clearly  (4:4). 

FY84  saw  increased  Air  Staff  participation,  but  the 
program  was  primarily  performed  by  base-level  Comptroller 
(AC)  divisions.  There  were  increased  reviews,  increased 
requirements,  and  340,000  manhours  (98:1)  expended  on  the 
program,  discovering  seven  material  weaknesses,  three 
repeated  from  the  prior  year  (98:1).  Of  the  original 
listing  of  231  subjects  mentioned  above,  74  additional 
highly  vulnerable  Air  Force-wide  subjects  were  selected  for 
ICRs  by  MAJCOMs  and  Separate  Operating  Agencies  (SOAs)  at 
approximately  110  installations  in  FY84  (4:2). 

FY85  changed  the  program  orientation  more  toward  the 
functional  areas,  increasing  their  responsibilities  while 
decreasing  direct  involvement  by  Cost  and  Management 
Analysis.  Full  Air  Staff  participation  was  expected  by  a 
1985  study  and  DOD  training  courses  were  to  be  developed 
and  issued  (98:2).  The  FY86  program  has  seen  further 

t 

decreased  involvement  in  the  field,  with  some  bases 
performing  no  ICRs  so  far  (72).  It  is  believed  by  some 
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that  the  Air  Staff  has  performed  the  required  vulnerability 
assessments,  found  low  risk  in  almost  all  cases,  and 
therefore  few  reviews  will  be  required  (55). 

Air  Force  internal  controls  are  considered  a  manage¬ 
ment  responsibility  which  is  applicable  to  every  Air  Force 
unit.  Air  Force  Internal  Control  systems  were  designed  to 
meet  the  standards  prescribed  by  the  Comptroller  General. 
The  Comptroller’s  standards  comply  with  the  Federal 
Managers’  Financial  Integrity  Act  of  1982,  OMB  Circular  A- 
123,  and  the  Department  of  Defense  Directive  5010.38  (see 
Appendix  B  for  a  listing  of  the  standards).  The  Air  Force 
has  implemented  an  Internal  Control  Review  Program  "as  a 
response  to"  these  requirements  and  the  standards  ahd 
objectives  outlined  in  the  original  DOD  Directive  7040.6 
(98:1).  The  objectives  are  intended  to  provide  DOD 
management  with  a  "reasonable  assurance"  (see  Appendix  B) 
that  financial  resources,  individual  office  or  function 
statistical  records,  and  other  valuable  resources  are 
protected.  This  is  accomplished  by  careful  adherence  to 
regulations,  laws,  and  policies  through  carefully  handling 
and  documenting  accountability.  The  standards  outline  the 
requirements  for  an  "audit  trail"  of  transactions.  An 
audit  trail  is  a  traceable  paperwork  path  showing  every 
step  of  a  process,  who  performed  it,  what  was  done,  why  it 

i 

was  done  that  way,  when  it  was  accomplished,  and  how  it  was 
completed.  This  audit  trail  allows  any  manager  to  trace  a 


transaction  from  beginning  to  end,  whether  or  not  he  or  she 
was  involved  in  the  actions  taken.  The  documentation 
required  in  the  original  guidance  received  by  this  author 
in  early  1983  from  her  Headquarters  stressed  the  need  for 
an  unquestionable  and  clear  audit  trail  when  completing  all 
Internal  Control  Reviews.  The  standards  also  call  for 
supervisors  to  separate  action  levels  (e.g.,  payments  for 
travel  from  the  auditing  of  the  travel  voucher),  so  that  no 
one  person  controls  an  entire  transaction,  thereby  reducing 
the  risk  of  loss  and  opportunity  for  fraud. 

The  Comptroller  of  the  Air  Force  has  been  designated 
the  office  of  primary  responsibility  (OPR).  His  office 
passes  Congressional  policy  down  the  chain  of  command, 
providing  training  and  guidance.  It  is  charged  with 
completing  vulnerability  assessments  at  least  biennially, 
taking  corrective  actions  as  required  and  reporting  the 
results  to  the  Secretary  (32:1). 

At  most  major  air  commands,  the  Cost  and  Management 
Analysis  (ACM)  function,  recently  realigned  and  renamed  as 
the  Cost  Analysis  (ACC)  function,  is  responsible  for  coor¬ 
dinating  the  annual  ICR  requirements  lists  with  command 
Functional  Area  Managers.  These  are  forwarded  to 
individual  bases  with  any  new  guidance.  This  annual 
listing  provides  each  command  (and  eventually  the  bases) 
with  an  enumeration  of  the  subjects  and  completion 
schedules  for  ICRs  due  during  that  fiscal  year.  Not  every 
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base  performs  every  ICR  required  for  the  fiscal  year.  For 
instance,  it  would  not  serve  a  purpose  to  require  a  base 
without  aircraft  to  perform  an  aircraft  inventory  check. 

Although  the  Comptroller  of  the  Air  Force  is 
ultimately  responsible  for  the  Air  Force  program, 

Commissary  Services  and  the  Accounting  and  Finance 
functions  have  separate  programs  from  the  one  managed  by 
Cost  &  Management  Analysis.  The  Air  Force  Reserve  and  the 
Morale,  Welfare  and  Recreation  function  also  have  their  own 
programs.  These  separate  programs  are  managed  by  their 
equivalent  commands;  for  example,  the  Accounting  and 
Finance  Center  (AFAFC),  who  then  report  directly  to  the 
Comptroller  of  the  Air  Force.  The  Accounting  and  Finance 
Center  in  Denver,  Colorado,  forwards  their  annual  require¬ 
ments  to  Finance  functions  at  bases  across  all  commands. 
Each  of  these  separate  programs  also  provide  separate 
guidance  and  maintain  separate  records  from  the  program 
being  studied  here.  In  all  the  literature  and  in  discus¬ 
sions  with  Comptroller  personnel,  this  author  found  that 
the  Accounting  and  Finance  program  was  highly  praised  and 
considered  very  effective.  The  most  frequent  comment  was 
that  their  (Finance’s)  program  works  very  ef f ectively--why 
can’t  ACC’s  work  that  way?  Accounting  and  Finance  has  had 
years  of  practice  doing  exactly  what  ICRs  mandate--managing 
resources  (55). 


Local  wing,  base,  and  unit  commanders  and  managers  are 
responsible  for  actual  compliance  with  established  con¬ 
trols,  review  of  the  vulnerability  of  an  asset,  adequacy  of 
daily  controls,  reporting  any  significant  deficiencies, 
breakdowns,  or  losses  through  the  chain  of  command,  and 
writing  performance  appraisals  to  reflect  any  serious 
breaches  of  internal  control  responsibilities  (32:1). 

The  monitor  of  the  program  at  base  level  is  the  Cost 
and  Management  Analysis  Branch  (ACC)  of  the  Comptroller 
Division.  ACC  is  also  charged  with  providing  policy 
guidance,  instructions  and  training,  coordination  of 
vulnerability  assessments  and  internal  control  reviews,  and 
preparation  of  required  reports.  ACC  may  also  be  tasked  to 
identify  and  outline  possible  topics  for  local  base/wing 
commanders  (18:3-4). 

Success  in  such  an  effort  relies  on  specification  of 
the  program  in  precise  language,  exact  definition  of  what 
is  expected  in  the  process,  and  end  products.  Careful  and 
competent  vulnerability  assessments  by  base  level 
Functional  Area  Managers  will  reduce  the  likelihood  of 
overlooking  possible  thefts  or  fraud.  They  should  also 
provide  chances  to  discover  opportunities  for  improving 
existing  procedures  and  regulations.  The  Air  Force  Audit 

Agency  (AFAA)  stated  that  whenever  ICR  performance 

» 

weaknesses  or  documentation  problems  were  found  during  the 
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first  year,  they  also  found  confusion  caused  by  "general, 
inconsistent,  and  nondirective  guidance  from  different 
sources"  (18:6). 


SRS-Slti-C..  FXQ.ble.rn 

Cost  and  Management  Analysis  personnel  seem  to  think 
there  is  a  lack  of  coordinated,  consistent  effort,  and 
centralized  control  in  the  Air  Force’s  implementation  of 
the  program.  Many  Cost  Analysts  question  whether  ICRs  meet 
the  intent  of  the  standards  set  forth  in  the  Act  (see 
Appendix  B) .  Personnel  within  Cost  and  Management  Analysis 
(ACC)  frequently  function  without  specialized  training  or 
educational  background  in  audit  procedures.  It  is  there¬ 
fore  difficult  and  time-consuming  at  best  to  accomplish 
ICRs  properly. 

"Internal  Controls  will  seek  to  prevent  as  well  as 
detect  waste,  loss,  unauthorized  use,  and  misappropriation" 
(32:1).  Overall  project  management  for  the  Department  of 
the  Air  Force  (DAF)  resides  with  the  Secretary  of  the  Air 
Force.  The  Secretary  is  charged  with  development,  documen¬ 
tation,  and  periodic  review  of  all  management  levels  to 
ensure  adequate  implementation  (32:1).  Cost  Analysis 
manages  the  program  (3:1). 

Base  level  Functional  Area  Managers  complete  Internal 
Control  Reviews  based  on  specific  topics  provided  in  annual 
command  schedules  from  their  equivalent  headquarters 
Functional  Area  Managers  (e.g.,  Civil  Engineering,  Security 


Police,  or  Chaplain).  MAJCOMs  and  SOAs  are  given  freedom 
to  expand  on  the  list.  Command-unique  or  high  risk  topics 
of  review  are  encouraged  (18:2-3).  Commanders  may  also 
designate  additional  topics  that  their  bases/wings  will 
review  (as  was  done  during  the  FY85  program) .  The 
completed  Internal  Control  Review  (ICR)  is  coordinated  with 
the  base/wing  level  Cost  and  Management  Analysis  Branch 
which  forwards  copies  through  the  base  or  wing  commander 
(depending  on  the  level  of  the  area  covered  in  the  ICR)  to 
the  command  Cost  Analysis  (ACC)  office  and  the  major 
command  Functional  Area  Manager.  Recently,  ACC  has  been 
withdrawn  from  the  reporting  process  and  Functional  Area 
Managers  forward  ICRs  directly  to  their  major  command 
equivalents . 

An  end-of-year  commander’s  certification  is  required 
to  summarize  the  well-being  of  each  command's  management 
control  systems.  The  major  commands  consolidate  the  end- 
of-year  reports  at  the  close  of  the  fiscal  year.  An  over¬ 
all  vulnerability  assessment  (see  Appendix  B)  of  the 
command  is  then  certified  by  the  appropriate  commander;  for 
example,  the  Commander-in-Chief,  Strategic  Air  Command. 

This  assessment  is  then  forwarded  through  the  HQ  USAF 
Directorate  of  Cost  Analysis  and  the  Secretary  of  the  Air 
Force  to  the  Secretary  of  Defense  (4:1).  It  includes  any 
corrective  actions  taken  when  significant  weaknesses  or 
discrepancies  were  noted.  The  base  level  Functional  Area 
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Manager  must  also  include  a  timetable  for  correcting 
problems.  The  Secretary  of  Defense  must  forward  this 
certification  further  up  the  chain  of  command  (3:1).  It  is 
also  reviewed  by  OMB. 

Each  executive  agency  conducts  a  vulnerability  assess¬ 
ment  of  internal  controls  within  areas  designated  by  the 
Comptroller  General  of  the  United  States  each  year  by 
December  31.  Assessments  are  then  done  at  least  biennially 
thereafter  on  the  same  topics  (63:2).  The  Office  of 
Management  and  Budget  (OMB)  and  Congress  are  then  appraised 
of  the  state  of  the  DOD’s  efforts  in  the  battle  against 
fraud,  waste,  and  abuse  (74:9). 

ICR  requirements  cause  problems  at  the  bottom  of  the 
management  chain,  the  individual  Air  Force  base  Functional 
Area  Managers  and  the  Cost  and  Management  Analysis  Branch 
(ACC).  Not  only  are  command  guidelines  extensive  and  often 
voluminous,  but  awareness  and  compliance  with  the  require¬ 
ments  to  perform  and  document  Internal  Control  Reviews 
create  possible  duplication  of  effort  with  a  previously 
existing  self -inspection  program.  Further,  the  Air  Force 
"already  had  a  system  to  review  our  internal  controls  -  the 
Air  Force  Audit  Agency"  (24:  i).  The  actual  performance  of 
an  internal  control  review  closely  parallels  the  steps  an 
auditor  follows  in  examining  a  function  (76:60).  It  is  a 
matter  of  adding  to  someone’s  workload  without  adding  the 
manpower  resources  (24:5). 


The  Air  Force  self -inspection  program,  strongly  recom¬ 
mended  by  AFR  123-1  and  required  at  least  annually  by  every 
major  air  command  supplement  found,  requires  managers  to 
safeguard  resources  and  document  compliance  with  the  Air 
Force-wide  fraud,  waste,  and  abuse  programs.  Self -Inspec¬ 
tion  checklists  can  be  used  straight  from  the  TIG  Brief,  a 
monthly  publication  of  The  Office  of  the  Inspector  General, 
along  with  command  ‘‘special  interest  items"  and  guidance, 
or  may  be  added  to  by  the  functional  manager  (20:1). 

Control  of  resources  is  further  covered  in  regulations  such 
as  AFR  67-10,  "Responsibility  for  Management  of  Public 
Property  in  Possession  of  the  Air  Force,”  and  equipment 
custodians  use  AF  Forms  126,  "Control  Logs"  in  property 
management  (95:11-12). 

MAJCOMS  have  these  self ^inspection  programs  and 
require  written  verification  that  an  inspection  was 
performed  periodically,  usually  a  minimum  of  twice  yearly. 
The  inspections  include  a  review  of  management  controls  and 
compliance  with  applicable  regulation,  and  the  written 
report  includes  a  copy  of  the  checklist,  discrepancies 
found,  and  the  date(s)  the  problems  were  corrected. 

Like  the  ICR,  this  self -inspection  report  is  open  to 
review  by  the  Air  Force  Audit  Agency  (AFAA)  and  is  expected 
to  provide  a  clear  audit  trail  (29:10).  The  author 
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believes  there  are  considerable  manhours  lost  through 
duplication  of  effort  since  her  prior  duty  assignment 


included  the  performance  of  both  self-inspection  and  ICRs 
and  the  subsequent  reports  required  by  both  programs. 

This  study  will  address  the  problem  of  compliance  with 
directives  and  possible  duplication  of  effort  with  other 
Air  Force  programs.  Duplication  of  effort  stems  from  the 
fact  that  the  ICR  program  requires  reports  concerning 
fraud,  waste,  and  abuse,  as  do  several  other  Air  Force 
programs,  especially  the  self -inspection  program. 

The  study  will  provide  analysis  for  reevaluation  of 
the  Internal  Control  Review  Program  to  be  forwarded  to  the 
Secretary  of  the  Air  Force  and  eventually  Congress. 

Further  complicating  the  ICR  situation,  the  method  of 
review  violates  one  of  the  basic  principles  of  internal 
controls,  that  of  separation  of  duties  (the  persons 
performing  the  job  are  asked  to  perform  the  ICR,  review  it, 
and  certify  that  they  are  doing  it  properly)  (24:1).  This 
study  will  seek  a  better  method  to  comply  with  requirements 
for  separation  of  duties. 

The  private  sector  also  employs  resource  protection 
systems.  However,  in  the  private  sector  discrepancies 
often  can  be  written  off  as  inventory  losses,  spoilage,  or 
discounts.  The  Federal  Government  and  Department  of 
Defense,  as  the  guardians  of  the  taxpayer’s  dollar,  cannot 
write  these  losses  off,  but  must  be  able  to  account  for 
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every  dollar  spent  to  Congress  and  the  public. 


Other  Federal  agencies  have  also  grappled  with  the 
implementation  of  the  Federal  Manager’s  Financial  Integrity 
Act,  apparently  quite  successful  in  some  cases.  The 
literature  review  will  look  at  some  of  these  departments, 
their  findings  and  recommendations  for  the  program,  as  well 
as  implementation  by  the  other  branches  of  military 
service. 

Objectives  of  the  Research 

The  overall  objective  of  this  research  is  to  determine 
an  improved  method  for  heightened  compliance  with  Air  Force 
Regulation  170-22,  the  use  of  Internal  Control  Reviews 
(ICRs)  as  an  anti-fraud,  waste,  and  abuse  tool.  AFR  170-22 
was  in  revision  for  over  two  and  one-half  years  and  has 
recently  been  put  on  hold  as  a  draft  regulation,  AFR  123-X, 
was  sent  to  the  field  during  June  1986,  and  a  revised  draft 
was  delivered  in  mid-July,  the  final  regulation  was  not 
published  as  of  August  1986. 

The  following  investigative  questions  will  be  the 
focus  of  the  research: 

1.  Can  program  improvements  render  Internal  Control 
Reviews  a  higher  quality  tool  for  safeguarding 
scarce  resources? 

2.  Are  base  level  personnel  managing  the  ICR  program 
in  accordance  with  the  directives?  Is  it  possible 
to  do  so? 

3.  Does  duplication  of  effort  between  programs  and 
among  offices  cause  a  loss  of  productivity  and 
incur  costs? 
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4.  Can  simplification  of  the  ICR  program  be  attained 
through  addition  to  the  self -inspection  program,  or 
conversely,  eliminating  separate  reporting  require¬ 
ments? 


5.  Can  experienced  ICR  monitors  suggest  workable 
improvements  to  the  program? 

Scope 

This  research  will  be  limited  to  Air  Force  personnel 
in  the  Comptroller  career  fields,  67XX  or  69XX,  who  have 
been,  or  are  currently,  Internal  Control  Review  monitors. 
The  Literature  Review  will  include  a  review  of  information 
concerning  both  the  Army  and  Navy  ICR  programs  and  programs 
in  several  other  Department  of  Defense  areas .  Some  private 
sector  programs  will  be  reviewed  also.  This  thesis,  there¬ 
fore,  may  apply  throughout  the  Air  Force  and  perhaps  other 
DOD  offices  if  it  is  found  that  greater  uniformity  of 
procedures  would  be  beneficial.  Specific  applications  may 
differ  with  each  agency  or  command  based  on  such  factors  as 
mission,  Cost  and  Management  Analysis  (or  equivalent)  per¬ 
sonnel  assigned,  and  management  level. 

Limitations  include  the  time  available  for  completion 
of  the  research  and  analysis. 

Summary 

In  continuing  actions  to  safeguard  scarce  resources, 
OMB  Circular  A- 123  was  published  requiring  each  governmen¬ 
tal  agency  to  annually  certify  the  status  of  its  internal 
control  systems  to  the  President  and  to  Congress. 


Due  to  the  volume  of  guidance,  the  ICR  program  often 
does  not  receive  attention  commensurate  with  its  impor¬ 
tance.  GAO  standards  are  often  violated,  and  possible 
duplication  of  effort  results. 

This  thesis  will  take  a  first  look  at  problems  and 
improvements  suggested  by  the  “experts"  struggling  with  the 
ICR  program  in  the  field. 
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II.  LITERATURE  REVIEW 


Introduction 

A  literature  review  was  conducted  from  published 
documents  pertaining  to  the  ICR  program. 

Several  master's  degree  theses  have  been  written  on 
the  subject  of  internal  controls,  all  products  of  the  Naval 
Post  Graduate  School  in  Monterey,  California.  The  Navy 
program  began  much  as  did  the  Air  Force  program  and  there¬ 
fore,  its  history  will  not  be  summarized  in  this  review 
(see  Martin  and  Berg  for  a  complete  summary).  In  1975  one 
author  recommended  that  a  study  be  conducted  to  investigate 
the  possibility  that  the  three  Navy  programs:  Internal 
Review  Program,  Internal  Control  Program,  and  the  Naval 
Audit  Service,  are  duplication  of  effort  and  should  be 
consolidated  (17:12). 

Several  General  Accounting  Office  (GAO)  Reports 
were  reviewed  to  gain  insight  into  the  past  and  current 
status  of  the  ICR  Program.  One  report,  concerning  ICRs 
which  reviewed  retiree  pay  processing,  noted  that  "the 
military  services  must  spend  more  time  determining  whether 
they  have  good  internal  controls"  (40:4). 

The  Air  Force  Comptroller  Magazine  Professional 
Military  Comptroller  School  (PMCS)  "idea  paper"  title  list¬ 
ings  yielded  numerous  papers  concerning  what  people  believe 
is  happening  within  the  ICR  program  and  their  suggestions 


for  improvement.  (The  "Idea  Paper"  is  a  report  of  facts 
and  opinions  on  a  topic  of  the  student’s  choosing.)  These 
papers  come  from  senior  level  comptroller  personnel  in  the 
Army,  Navy,  Marines,  and  Air  Force,  both  officer  and 
civilian,  yielding  a  good  cross-section  of  ideas  concerning 
all  phases  of  the  DOD  program. 

In  the  Air  Force,  several  other  areas  perform  ICRs 
besides  the  ACC  function  of  the  Comptroller  Division.  Air 
Force  Accounting  and  Finance  (ACF),  although  another  branch 
within  the  Comptroller  Division,  has  a  separate,  pre¬ 
existing  program  directed  by  the  Accounting  and  Finance 
Center  in  Denver  Colorado  (49). 

There  are  other  divisions  on  an  Air  Force  base  that 
also  have  their  own  ICR  programs.  They  include  the 
Commissary  Services  group,  the  Air  Force  Reserve,  and  the 
Morale,  Welfare,  and  Recreation  Division.  These  groups  may 
all  call  upon  ACC  for  guidance  and  training,  but  rarely  do 
so  ( 55 ) . 

ACF’s  reviews  are  similar  to  a  Quality  Assurance 
program  that  has  been  in  existence  for  many  years.  Their 
reviews  are  considered  well  planned  and  are  well  received 
by  their  personnel.  ACF  and  ACC  at  some  bases  work 
together  when  reviewing  ICRs.  The  ACF  reviews  are  not  part 
of  the  ICRs  counted  into  the  ACC  schedule,  nor  are  those 
performed  by  the  other  areas  listed  above  (49).  ACF  re¬ 
ceives  their  guidance  directly  from  AFAFC,  Denver,  CO  (19). 
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The  Adams  &  Warywoda  thesis  provided  an  in-depth 
history  of  the  evolution  of  the  current  federal  principles 
on  internal  controls  and  their  application  in  the  Navy. 

The  authors  reviewed  several  instances  where  mismanagement 
or  misuse  and  fraud  cost  the  Navy  thousands  of  dollars. 

Most  of  the  time  the  involved  parties'  "fitness  reports" 
(annual  performance  evaluations)  did  not  reflect  the 
problems.  In  one  case,  an  officer  received  a  low  fitness 
report  for  not  being  a  "team  player",  that  is,  for  not 
misusing  the  system  (1:13).  This  officer  was  concerned 
that  he  would  not  be  promoted  further,  although  some  of  the 
officers  involved  in  mismanagement  were  promoted  on  their 
"first  screening"  (1:11,13).  The  Lancaster  thesis  also 
traced  the  history  of  auditing.  The  history  discussed  the 
evolution  of  accounting  from  the  dawn  of  recorded  history 
to  the  present  (60). 

The  consensus  among  the  studies  reported  here  is  that 
there  must  be  less  costly  and  less  complex  ways  to  carry 
out  a  program  and  that  such  methods  should  be  second  nature 
to  managers  (1;  24)  and  should  be  included  in  their  perfor¬ 
mance  measures.  The  literature  concludes  that  the  program 
takes  a  great  deal  of  time  from  regular  duties  in  Cost  and 
Management  Analysis  (or  the  other  services'  equivalents)  as 
well  as  from  the  Functional  Area  Managers  (96:9).  They 
conclude  that  total  costs  exceed  the  benefits  received. 


There  is  some  evidence  of  lack  of  compliance  including 
“pencil  whipping"  reports  to  meet  dead-lines.  "Managers 
perceive  the  ICP  as  a  bureaucratic  albatross,  and  therefore 
have  relegated  it  a  low  priority"  (79:10).  Commanders  seem 
,to  lack  interest  in  "just  another  Comptroller  exercise" 
(48:10)  possibly  brought  on  by  political  motivation  (47:1) 
and  in  general  are  not  getting  involved  (48:11).  Internal 
control  personnel  seem  to  lack  understanding  of  program 
importance  and  just  exactly  what  constitutes  a  "good" 
control  (99:9).  Without  proper  redirection,  one  author 
thinks  the  program  will  become  another  mandatory  "to  do" 
rather  than  a  serious  attempt  to  strengthen  internal 
controls  ( 79 :  i )  . 

Professional  Military  Comptroller  School  (PMCS) 

students  representing  all  four  services  were  questioned  by 

Pugh  (1985)  and  in  general,  report  that: 

ICPs  [Internal  Control  Programs]  were  ineffective.  A 
common  perception  among  [PMCS]  Class  85-D  was  that 
PL  97-255  was  never  intended  to  apply  to  the  DOD. 

The  consensus  was  that  DOD  agencies  had  existing 
internal  control  mechanisms  (inspector  generals  [sic], 
audit  agencies,  staff  assistance  visits,  self¬ 
inspection  programs)  upon  enactment  of  PL  97-255.  In 
other  words,  Congress  drew  its  target  circles  around 
all  executive  agencies  rather  than  just  those  non-DOD 
agencies  that  were  the  bullseye  of  the  problem. .. The 
major  difference  is  that  managers  must  now  laboriously 
document  their  internal  control  processes  [79:6,8]. 

Other  problem  areas  found  during  the  literature  review 

included  lack  of  reporting  of  material  weaknesses  by 

several  government  agencies  (14:5;  12:6),  inadequate  formal 

follow-up  procedures  when  weaknesses  were  identified,  and 
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exclusion  of  internal  management  control  issues  and  respon¬ 
sibilities  from  performance  appraisals  (14:3;  12:6).  Auto¬ 
matic  Data  Processing  (ADP)  internal  control  requirements 
evaluations  were  not  included  in  many  early  ICRs  and  are 
still  considered  a  difficult  area  to  judge  (12:6;  14:5). 
Computers  are  becoming  part  of  the  daily  office  routine. 

As  their  use  grows  throughout  DOD,  the  need  to  safeguard 
the  both  the  equipment  and  the  data  stored  on  disks  also 
grows.  Personnel  outside  of  the  Air  Force  Information 

t 

Services  Command  tend  to  ignore  ADP  considerations.  This 
lack  of  concern  is  found  in  individual  offices  in  the  Navy 
as  well  as  Air  Force  (1:104). 

The  Oppe’  thesis  provided  case  histories  of  malfea¬ 
sance  involving  both  the  public  and  private  sectors.  The 
emergence  of  internal  controls  in  both  the  public  and 
private  organizations  were  traced  and  similarities  under¬ 
lined.  Her  comparison  of  ICR  "event  cycles"  to  private 
companies’  "transaction  cycles"  as  the  first  step  in 
setting  up  a  system  of  internal  controls  for  both  suggest 
that  0MB  is  attempting  to  pull  the  Federal  Government 
closer  and  closer  to  a  more  business-like  orientation 
(76:42-48) . 

Her  study  stressed  the  need  for  internal  controls  to 

be  dynamic.  As  systems  change,  so  should  the  controls 

» 

placed  over  them.  Loss  of  a  long-time  employee  or  addition 


of  a  new  duty  could  be  events  triggering  reevaluation  of 


current  controls:  are  new  ones  needed,  should  some  be 
eliminated  or  expanded  (76:67)? 

Standards 

Most  of  the  PMCS  papers  reviewed  the  history  of  the 
internal  control  system  requirements  and  the  vulnerability 
assessment  procedure.  More  than  one  author  touched  on  the 
necessity  for  meeting  the  GAO  standard  for  "independent  and 
objective  evaluation  of  the  systems  of  internal  control" 
charging  managers  with  the  responsibility  for  establishing 
these  controls  and  a  person  independent  from  the  process 
with  the  evaluation  (53:7;  82: i).  This  leads  to  the 
conclusion  that  the  Functional  Area  Managers  (FAMs)  who 
perform  ICRs  may  not  be  the  independent  evaluators  required 
to  meet  GAO  standards  and  the  concept  of  separation  of 
duties  (described  in  Appendix  B).  One  author  calls  for 
reviews  to  be  performed  by  someone  outside  the  function 
under  review  (53:11). 

The  literature  repeatedly  mentioned  the  need  for 
dynamic  and  robust  internal  controls.  Also  seen  were 
references  to  the  need  for  building  internal  controls  into 
all  new  systems  (99:10). 

The  Dykes  thesis  was  completed  in  June  1982,  at  the 
Naval  Post  Graduate  School.  Although  it  focused  primarily 
on  audit  standards  ‘ issued  by  the  General  Accounting  Office 
(GAO)  in  1972  and  revised  in  1981,  and  how  they  were 


employed  in  the  state  of  California;  their  relationship  with 

internal  controls  was  clear: 

The  concept  of  internal  auditing  envisioned  by  the 
forward  looking  General  Accounting  Office  (GAO)  was 
that  of  an  independent  organization  installed  within 
the  various  levels  of  government  to  not  only  review 
financial  statements,  but  also  to  aid  management  in 
the  achievement  of  its  goals  by  including  a 
consideration  as  to  the  effectiveness  of  control 
systems  and  related  administrative  practices  [1:11]. 

The  standards  for  auditing  and  those  for  internal 

controls  are  similar.  The  auditing  standards  may  be  found 

at  Appendix  C  (1: Appendix  B).  In  addition,  the  definitions 

of  internal  auditing  and  internal  control,  are  similar. 

Both  are  considered  management  tools;  systems  of  controls 

in  an  organization  to  determine: 

whether  applicable  policies  and  procedures  are 
followed,  standards  set,  resources  are  used 
efficiently  and  economically  and  the  organization’s 
objectives  are  being  achieved  [1:12]. 

GAO  auditing  standards  (Appendix  C)  call  for  reviews 

to  be  performed  by  knowledgeable  individuals,  "high  quality 

individuals."  They  call  for  "independence"  that  is:  no 

personal  impairments,  for  instance  financial  interest  in 

the  results;  no  external  impairments,  such  as  fear  of 

retaliatory  actions;  and  no  organizational  impairments, 

that  is  no  political  pressures  which  can  be  levied  (1:40— 

41).  The  GAO  standards  continue  to  be  similar  to  the 

internal  control  standards  by  calling  for  appropriate 

guidance  and  supervision,  plus  making  sure  that  "working 

papers  properly  document  and  support"  the  findings  (1:42). 
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The  audit  standard  of  internal  controls  repeats  the 

formal  definition  of  internal  controls  used  in  Chapter  One 

of  this  thesis.  They  are: 

organizational  plans,  methods  and  utilized  measures 
that  safeguard  assets,  verify  the  accuracy  of 
financial  transactions  and  encourage  compliance  with 
managerial  policies,  procedures,  and  practices  [1:43]. 

The  Adams  and  Warywoda  thesis  reviewed  the  components 

of  a  "good"  internal  control  system  in  light  of  the  revised 

OMB  Circular  A-123.  They  felt  that  the  requirements  of  the 

Circular  and  subsequent  instructions  down  the  chain  from 

/ 

DOD  through  the  Naval  Medical  Command  "key  on  internal 
review  which  GAO  emphasized  as  an  element  of  a  satisfactory 
internal  control  system"  (1:36). 

A  1981  report  from  the  Comptroller  General  attributed 
mismanagement  and  misuse  of  federal  funds  to  weaknesses  in 
the  systems  of  internal  controls  at  several  community 
action  agencies.  Excess  cash  had  been  diverted  into  unre¬ 
corded  bank  accounts  (36:7),  embezzled  (36:8),  or  used  to 
subsidize  other  activities  (36:8-10).  After  tracing  the 
spurious  activities,  the  Comptroller  General  called  for 
increased  funds  control  to  preclude  recurrence.  The  main 
conclusion  of  the  report  was:  "Good  internal  controls  are 
the  most  effective  deterrent  to  mismanagement  and  misuse  of 
funds"  (36:26). 

A  1981  letter  to  the  Comptroller  General  from  OMB 

I 

attached  to  the  report  stated  that  OMB  had  formed  an  Inter¬ 
nal  Control  Task  Force  consisting  of  "representatives  from 


OMB,  the  General  Accounting  Office,  and  each  major  Federal 
agency  to  draft  policies  and  standards  for  agency  internal 
control"  (36:37).  Although  no  other  mention  of  this  task 
force  was  found,  the  policies  and  standards  being  drafted 
were  most  likely  those  subsequently  published  as  OMB 
Circular  A-123. 

Dykes  used  a  questionnaire  to  determine  the  degree  of 
compliance  with  the  1972  GAO  audit  standards,  to  seek 
underlying  causes  of  any  deviations  and  to  make  recommen¬ 
dations  for  improvement  (1:15).  He  found  that  the  GAO 
standard  of  independence/segregation  of  duties  was  fre¬ 
quently  violated  in  the  California  municipal  government 
auditing  procedures  (1:105-7). 

Adams  and  Warywoda  also  prepared  a  questionnaire  which 
was  mailed  to  all  28  Navy  Medical  Supply  Officers  not  in 
Europe  (1:40).  The  questions  were  oriented  toward  Navy 
Medical  Management  and  the  findings  are  difficult  to  relate 
to  Air  Force  ICRs  due  to  management  structure  and  opera¬ 
tional  differences,  but  this  questionnaire,  the  one  by 
Lancaster  (reviewed  below)  and  that  of  Dykes  became  the 
foundation  for  many  of  the  questions  used  to  obtain  data 
for  this  study  (1:126-133;  1:75-84;  60:188-190). 

Cost/Benefit  Relationship 

The  cost/benefit  relationship  was  discussed  frequently 
» 

in  the  literature:  benefits  should  exceed  costs  whenever 


possible.  Most  often  noted  was  that  better,  not  more, 


controls  are  needed  and  all  managers  are  responsible  for 
the  success  or  failure  of  an  internal  control  program 
(1:24). 

Oppe’  stressed  the  cost/benefit  relationship  as  did 
Adams  and  Warywoda.  She  felt  that  direct  and  indirect  costs 
of  excessive  controls  "can  far  outweigh  the  risks  of 
adequate,  but  not  absolute,  control"  (76:67).  Stress  on 
cost  of  implementation  versus  expected  benefits  was  seen 
throughout  the  literature  (96:10).  The  implication  for  a 
future  study  to  assess  costs  seems  clear  and  will  be 
discussed  in  a  later  chapter. 

Manning  and  Training 

Other  papers  suggested  that  training  was  inadequate 
for  the  limited  number  of  persons  involved  in  the  internal 
control  process  (43:4;  10:3;  81:10).  Most  of  Dykes’ 
findings  were  peculiar  to  California  government,  but  his 
findings  that  formal  training  programs  were  lacking  is  also 
found  in  the  DOD,  and  his  study  provides  insight  into  the 
common  problem.  Survey  participants  made  use  of  private 
continuing  education  and  professional  seminars  to  fill  the 
gap.  They  desired  additional  employer-provided  training  in 
the  areas  of  Automatic  Data  Processing  (ADP)  and  accounting 
systems  (33:104).  Most  auditors  were  found  to  have  the 
basic  education  required  to  perform  the  audits  competently 
(33:103). 
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Air  Force  Commissary  Services  had  difficulty  in  imple¬ 
menting  their  program  partly  due  to  lack  of  emphasis  and 
inadequate  staffing  (96:8-9;  10:6).  The  theme  of 
inadequate  manning,  recurrent  throughout  the  literature, 
was  repeated  here.  The  author  stated  the  case  clearly: 

It  has  been  most  unrealistic  of  OMB  to  inject  such  a 
program  without  providing  the  resources  to  accomplish 
the  program.  Both  program  [ACM]  and  functional  manage¬ 
ment  personnel  were  fully  tasked  before  the  requirement 
for  internal  control  reviews  was  established  [96:9]. 

His  concern  is  that  while  performing  ICRs,  regular 

* 

assigned  duties  will  be  forced  aside  and  neglected  (96:10). 
The  reader  is  reminded,  however,  of  Pugh’s  suggestion  that 
OMB  never  intended  for  additional  audits  to  be  added  to  the 
existing  DOD  system  (78:6,8). 

Lancaster  found  that  offices  surveyed  felt  staffing 
was  inadequate  to  properly  fulfill  review  requirements 
(60:104);  most  personnel  assigned  had  the  required 
technical  expertise,  but  that  was  defined  as  merely  meeting 
Navy  minimums  (60:105).  Lack  of  performance  and  reporting 
deficiencies  often  blamed  on  inadequate  training  and 
manning  ( 60 : 108 ) . 

Information  Sharing 

One  author  stated  that  inaccurate  information  was  to 
be  expected  because  of  the  lack  of  awareness  and  program 
definition  (54:6).  '  The  main  reason  ICRs  will  reflect  in¬ 
accurate  information  is  due  to  management  philosophy,  the 
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reluctance  of  managers  to  “air  their  dirty  laundry"  by 
holding  up  problems  for  scrutiny  by  higher  level  management 
(54:7),  even  through  the  ICR  program  also  allows  for  state¬ 
ments  of  corrective  action  taken  or  planned.  A  third 
reason  cited  for  inaccurate  information  in  ICRs  was  too 
large  a  mission  with  too  few  resources  (54:7).  This  is  a 
restatement  of  Forsythe’s  "program  unresourced"  (34:6-8). 

One  GAO  report  discussed  the  need  for  four  Federal 

Agencies  to  share  information  concerning  approaches  they 

* 

employed  to  identify  and  report  internal  accounting  and 
administrative  control  system  weaknesses.  This  "informa¬ 
tion  sharing,"  either  through  formal  reports,  telephone 
calls  or  other  informal  methods,  was  helpful  to  these 
agencies  by  increasing  awareness  of  fraud  opportunities  and 
recently  found  prevention  measures.  Again,  cost  of  ac¬ 
quiring,  analyzing,  and  distributing  the  information  versus 
its  potential  benefits  was  listed  as  an  important  issue. 

One  agency  distributed  "Fraud  Alerts”  periodically  to 
heighten  its  internal  agency  awareness  of  vulnerable  areas 
and  recurring  fraud  schemes  (41).  This  suggests  that 
sharing  of  ICR  reports  with  source  information  deleted 
could  be  of  benefit  in  preventing  discrepancies  or 
weaknesses  at  another  organization.  The  procedure  would 
not  be  costly  since  Inspector  General  (IG)  findings  for 
each  ACC  are  already  forwarded  after  inspections. 


The  Oklahoma  City  Air  Logistics  Center  Comptroller 
formed  a  "quality  team"  from  within  their  Internal  Control 
Review  Coordinating  Group.  Each  member,  besides  being  a 
member  of  the  coordinating  group,  is  the  functional 
organization’s  ICR  monitor. 

When  ICRs  are  performed,  the  center  uses  an  evaluation' 
checklist  compiled  by  their  ACM  along  with  a  set  of 
policies  and  procedures  from  the  coordinating  group  to 
ensure  adequacy  and  documentation  completeness  (18:8).  The 
group  believes  that  these  policies,  procedures,  and  the 
checklist  will  bring  conformity  to  the  Air  Force  Logistics 
Command  (AFLC)  ICRs  as  they  are  used  command-wide  in  forms 
tailored  to  specific  missions  (18:10).  The  checklist,  with 
some  revision,  could  easily  be  used  in  any  command  for  any 
ICR  and  should  be  shared,  but  no  evidence  was  found  that 
the  documents  were  recommended  to  anyone  outside  of  AFLC 
(55). 

In  several  PMCS  papers,  the  authors  recommended  a 
"top-down"  recommitment  approach  to  ICRs  in  order  to 
utilize  experience  and  the  perspective  of  involved  organi¬ 
zations,  any  function  short  on  expertise  could  then  seek 
assistance  (66:14).  This  approach  would  also  ensure  that 
managers  at  all  levels  were  aware  that  the  Internal  Control 
Program  (ICP),  including  ICRs,  had  the  full  backing  and 
support  of  their  agency  heads  (99:11)  while  expressing 
dissatisfaction  with  the  current  ICP  efforts  (79:11).  If 


required  ICR  reports  lists  were  provided  to  each  function 
early  in  the  fiscal  year,  it  would  allow  better  scheduling, 
more  information  sharing,  and  a  better  product  (66:14).  It 
would  also  ensure  upper  level  awareness  and  involvement  in 
the  ICP  (97:4). 

A  paper  from  an  AFLC  program  analyst  mentioned  that 
AFLC  published  AFLC  Regulation  170-5  to  provide  "objec¬ 
tives,  policies,  responsibilities,  procedures,  and  report¬ 
ing  requirements  for  the  complete  program"  (10:2).  This 

t 

should  be  one  of  the  first  items  included  in  an  information 
sharing  program  between  commands. 

One  Army  paper  called  for  automation  of  the  internal 
review  process  (77:8).  Once  a  new  guiding  regulation  is 
published,  this  could  be  a  labor  saving  idea.  Networking 
could  then  provide  the  information  sharing  suggested  by 
other  papers  as  well  as  speed  a  final  report  to  the 
requesting  headquarters. 

At  the  very  least,  mandatory  information  sharing 

between  ICR  monitors  was  suggested  (81:8).  Other  types  of 

inspection  reports  are  currently  passed  through  command,  so 

ICRs  without  unit  identification  could  be  forwarded  to 

other  monitors  as  well.  It  might  be  more  desirable  "to 

require  functional  managers  at  one  base  to  review  internal 

controls  at  another  base”  (48:12-13).  One  interviewee 

\ 

suggested  that  headquarters  should  direct  crossfeed  of  ICRs 


to  improve  ICR  performance,  problem  awareness,  and 
correction  measures  (55). 

Guidance  and  a  New  Regulation 

Documentation  of  the  completed  reviews  was  frequently 
inadequate  due  to  the  absence  of  provision  of  an  acceptable 
audit  trail  (43:5).  The  Air  Force  was  singled  out  and 
cited  for  failure  to  list  a  specific  problem  within  a 
material  weakness  area  which  precluded  OSD  and  Congress 
from  "effectively  measuring  successful  resolution"  of  the 
problem  found  (43:7).  Similar  complaints  were  echoed  in 
the  study  by  Dykes  (1982)  and  also  in  the  PMCS  papers. 

Inadequate  documentation  or  excess  paperwork,  along 
with  poorly  written  ICR  planning  and  control  procedures, 
were  found  to  be  areas  of  concern  in  Air  Force  Audit  Agency 
(AFAA)  reports  (10)  as  well  as  in  the  "idea  papers"  (96:8; 
79:4).  The  AFAA,  in  their  evaluation  of  the  first  year  of 
the  program  noted  that : 

whenever  weakness  in  performing  and  documenting  vul¬ 
nerability  assessments  and  internal  control  reviews 
was  found,  confusion  caused  by  general,  inconsistent, 
and  nondirective  guidance  from  different  sources  was 
also  present  [18:6]. 

More  than  one  "idea  paper’  documented  the  lack  of 
guidance  at  the  onset  of  the  program  followed  by  a  paper¬ 
work  avalanche  (34:5;  99:3)  which  led  to  confusion  and 
variations  in  program  implementation  due  to  "information 
overload"  (79:4).  Other  papers  called  for  simplification 
of  MAJCOM  guidance  packages.  In  one  paper,  Jay  Wallace 
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(1984)  stated  that  he  received  a  150  page  instruction 
package  from  HQ  USAF  while  serving  as  the  Strategic  Air 
Command’s  (SAC)  project  officer.  While  it  was  a  thorough 
set  of  instructions,  he  questioned  the  understandability 
and  usefulness  of  the  document  because  of  its  complexity, 
length,  and  lack  of  readability  (95:2). 

This  author  also  remembers  lengthy  packages  from  her 
command.  The  base  level  packages  would  be  complicated 
further  by  such  things  as  MAJCOM  forms  (FY84)  and  MAJCOM 
guidance  added  to  the  already  large  (150  pages)  HQ  USAF 
package.  Regardless  of  the  education  level  of  the  monitor, 
volume  alone  could  deter  the  reader  from  doing  more  than 
skimming  the  contents  of  such  a  large  package.  In  FY85, 
the  instruction  package  was  further  enlarged  by  several 
volumes  of  training  manuals  totaling  370  pages  of 
instructions,  descriptions,  charts,  and  related  ICR 
information  (49).  The  very  nature  and  complexity  of  the 
instructions  and  the  time  required  to  grasp  the  information 
by  both  the  monitor  and  the  Functional  Area  Manager  may 
encourage  "a  less  than  totally  honest  ef:':rt — perhaps  even 
a  'pencil  whip’"  (95:3).  These  training  manuals  were 
written  especially  for  the  Air  Force  for  FY85  by  civilian 
contractors  and  were  not  used  again  for  the  FY86  directed 
reviews  (49). 

There  were  calls  for  revision  and  expansion  of  AFR 
170-22,  feelings  ran  high  that  program  guidance  should  not 
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be  changed  "as  one  changed  one’s  socks,"  but  should  be  in 
the  regulation  (40:13;  97:11).  A  draft  regulation,  re¬ 
numbered  AFR  123-X,  was  received  in  the  field  during  S[ring 
of  1986  with  a  request  for  suggestions  to  be  returned  to 
hoadqnnrtern ,  nnd  n  rnvi sad  edition  would  follow.  Even  the 
revised  draft  AFR  123-X,  received  in  early  summer  1906,  has 
met  with  criticism  for  not  going  far  enough  into  solving 
the  problems  identified  with  the  original  AFR  170-22  (55). 
Numerous  changes  suggested  to  USAF/ACC  will  be  incorporated 
in  the  new  AFR  123-4  (currently  the  numerical  designator 
assigned  to  the  final  AFR  123-X,  if  and  when  it  is 
published  (55). 

Problems  have  already  arisen  and  there  have  been 
delays  in  publishing  the  new  regulation  including  a 
possible  change  back  to  the  "170"  series  (Comptroller 
regulations)  rather  than  the  Inspection  "123"  series  (55). 
All  of  this  indecision  has  delayed  approval  of  the  revised 
procedures  and  made  the  job  of  the  ICR  personnel  in  the 
field  more,  rather  than  less  difficult.  Further,  although 
the  draft  regulation  appears  to  "go  a  long  way"  toward 
making  the  ICR  program  an  "umbrella"  for  many  other  fraud, 
waste,  and  abuse  programs,  extensive  year-end  paperwork  for 
commanders’  certification  is  even  more  complex  than  the 
original  program  (55;  49;  90). 

The  Air  Force 'Audit  Agency  report  on  the  FY84  ICR 
program  also  called  for  revision  of  AFR  170-22.  The 


Auditor  General's  report,  cover  letter  stated,  "We  recommend 
a  single  Air  Force  directive  be  issued  to  all  program 
participants  specifying  all  program  responsibilities, 
procedures,  and  methods"  (4:i,7). 

Program  Placement 

Unlike  later  authors,  Oppe’  believes  that  an  internal 
review  function  is  "ideal"  when  placed  in  a  "staff  capacity 
to  the  commanding  officer  to  ensure  independence  from 
operational  activities  and  objectivity  in  the  internal 
evaluation  of  the  organization"  (76:59). 

One  paper,  after  identifying  the  major  internal 
problem  within  the  Comptroller  Division  as,  "which  division 
will  be  responsible  for  managing  the  problem, "  suggested 
that  a  new  function  be  established  within  the  division 
whose  "primary  mission"  would  be  designated  as  the 
management  and  monitoring  of  the  internal  control  program 
(Army)  (54:1,2).  The  author  stated  that,  considering  the 
corporate  knowledge  within  the  Comptroller  community, 
Comptroller  personnel  could  provide  assistance  to  the 
functional  areas  designated  to  perform  the  reviews 
evaluating  internal  control  systems  (54:6).  "Role  playing" 
was  suggested  as  a  training  technique  or  to  test 
performance  when  reviewing  internal  controls.  This  would 
help  to  identify  the  controls  that  do  not  exist  but  are 
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needed  and  what  might  happen  if  the  controls  were  not  in 
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place.  They  could  highlight  areas  with  excessive  controls 
or  controls  that  are  no  longer  useful  (69:4). 

Another  paper  stated  that,  with  proper  staffing,  ACC 
could  assume  the  increased  responsibilities  and  a  function 
separate  from  the  Comptroller  (such  as  the  AFAA)  should  not 
be  established  nor  further  tasked  (91:1-2).  The  Navy 
program  also  locates  the  ICR  function  within  their 
Comptroller  operation  '91: 2). 

Two  other  authors  also  believed  that  Cost  and  Manage¬ 
ment  Analysis  (now  ACC)  was  the  perfect  location  for  ICRs 
since  personnel  are  familiar  with  quantitative  methods  and, 
at  all  management  levels,  are  capable  of  turning  collected 
data  into  useful  information,  performing  trend  analysis  on 
risk  or  vulnerability  data  within  an  ICR  area,  and 
performing  special  studies  related  to  internal  control 
weaknesses  (63:14;  82:8).  Although  ACC  now  performs 
special  studies,  called  Management  Assistance  Services 
(MAS),  the  function  "would  have  to  be  staffed  to  cope  with 
this  additional  tasking"  (63:14).  As  is  the  case 
presently,  the  problem  is  one  of  personnel  resources. 

Since  manning  in  ACC  (discussed  earlier)  is  strained, 
perhaps  the  Internal  Control  Review  Program  could  be  joined 
to  another  such  program  to  partially  alleviate  the 
placement  or  manpower  question? 

An  article  in’ the  Armed  Forces  Comptroller  established 
that  internal  controls  and  the  productivity  improvement 
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program  have  the  same  objective,  "efficient  use  of 
resources,"  and  therefore,  internal  controls  should  "be  the 
focal  point  of  productivity  improvement"  (86:39).  The 
author  further  recommended  that  the  two  programs  be 
"accomplished  together"  in  the  functional  areas  because  of 
the  interdependence  and  impact  of  the  "efficient  use  of 
resources"  (86:39). 

even  more  closely  related  to  effective  and  efficient 
use  of  resources  is  the  self -inspection  program.  Self¬ 
inspections  were  viewed  by  some  authors  as  inadequate  or 
ineffective  in  identifying  weaknesses  in  internal  controls. 
This  inefficiency  was  further  blamed  on  lack  of  command 
support  for  the  ICR  program  from  HQ  USAF  through  MAJCOM  and 
SOA’s  to  the  installation  level  (60:9).  Wallace  disagreed, 
stating  that  internal  controls  can  be  simplified  through 
better  self -inspection  (95:6). 

Wallace  also  recommended  a  revision  of  the  current 
self -inspection  program  with  checklist  items  covering  com¬ 
pliance  with  internal  control  requirements.  The  spirit  of 
the  documentation  requirements  would  necessitate  more  than 
yes/no  answers  to  ensure  that  the  process  of  evaluating  the 
controls  was  also  trackable  and  repeatable  (95:5).  Stover 
recommended  including  fraud,  waste,  and  abuse  (FW&A)  items 
in  the  existing  internal  (self)  inspection  program  to 
preclude  creating  *a  separate  new  system.  He  said  that  all 
medical  treatment  facilities  personnel  must  "zero  in  on 


potential  FW&A  problems  in  their  sections"  and  felt  that 
the  self -inspection  program  could  fill  this  need  without 
creating  a  new  reporting  requirement  (89:14).  Stover 
implied  that  the  FW&A  coverage  in  self -inspections  could 
easily  expand  to  include  documenting  internal  management 
control  reporting  requirements  (89:14). 

In  his  paper,  Forsythe  states  that  the  Army’s  Internal 
Control  Program  (ICP)  problem  areas  could  be  summarized  in 
seven  areas: 

(1)  Lack  of  specific  ICP  training, 

(2)  Emphasis  on  paperwork  and  reports, 

(3)  Program  directed  through  functional  channels  [e.g. 
no  command  emphasis,  no  authority  to  complete], 

(4)  Manager's  resistance  [to  the  program  in  general], 

(5)  Poor  program  guidance, 

(6)  Inaccurate  Commander’s  certifications, 

(7)  Program  unresourced  [e.g.  no  additional  manning] 
[34:6-8] . 

Forsythe  believes  that  managers  and  supervisors  will 
in  effect  ignore  the  program  because  no  accountability  is 
levied  on  first  line  supervisors  and  supervising  personnel 
are  not  rated  for  this  area  (34:14). 

System  Wsaknsgggg 

One  GAO  report  discussed  the  inability  of  the  National 
Aeronautics  and  Space  Administration  (NASA)  to  adequately 
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met  the  Federal  Financial  Managers’  Act  provisions.  The 
report  stressed  the  need  for  the  agency  head  to  consider 


four  items  when  determining  the  status  of  its  internal 
controls : 

(1)  significance  of  the  weaknesses  disclosed  by  the 
agency , 

(2)  status  of  corrective  actions, 

(3)  comprehensiveness  and  quality  of  the  internal 
control  evaluation  work  performed,  and 

(4)  extent  to  which  accounting  systems  conform  with 
the  Comptroller  General’s  requirements  [45:2]. 

The  implications  were  that  NASA  did  not  disclose  any 
internal  control  weaknesses  through  the  chain  that  had  been 
identified  by  some  of  their  internal  review  activities.  A 
follow-up  program  had  not  yet  become  operational  in  NASA 
(45:3).  A  possible  reason  advanced  for  problems  not  being 
reported  up  through  management  channels  was  that  correc¬ 
tions  were  in  progress.  This  was  deemed  inconsistent  with 
the  provisions  of  the  Act  for  reporting  material  weaknesses 
with  plans  and  schedules  for  correction  (45=5).  One  of 
NASA’s  identified  weaknesses  concerned  computer  operations 
of  the  space  shuttle,  but  a  specific  area  was  not  cited 
(45:5). 

An  additional  GAO  report  discussed  the  Department  of 
Defense’s  (DOD’s)  first  year  implementation  of  the  Act,  by 
looking  into  22  agencies’  efforts  during  implementation. 
Contained  in  the  DOD  Inspector  General’s  assessment  was  the 
recommendation  that  the  "Secretary  of  Defense’s  December 
1983  statement  be  qualified  to  acknowledge  that  the 


int.ornnl  control  proc«.*?s  was  not  complete  and  consistent 


within  the  department"  which  is  consistent  with  comments 
read  in  the  Professional  Military  Comptroller  School  (PMCS) 
papers  reviewed  (43:3). 

Another  GAO  report  concerned  the  "Air  FOrce’s  Progress 
in  Implementing  the  Federal  Financial  Managers’  Integrity  - 
Act."  The  report  stated  that,  although  improvements  were 
seen  over  the  previous  FY,  the  Secretary  of  the  Air  FOrce 
should  not  yet  report  that  AF  internal  control  systems  met 
the  requirements  of  the  Act.  Several'  points  for  improve¬ 
ment  were  noted;  specifically  that  the  Secretary  should 
direct  the  Comptroller  of  the  Air  Force  to  ensure  that: 

(1)  managers  who  perform  vulnerability  assessments 
and  ICRs  are  adequately  trained; 

(2)  ADP  general  and  application  control  reviews  are 
incorporated  into  ICR; 

(3)  [DOD]  ADP  Internal  Control  Guidelines  are 
included  as  part  of  the  [AF]  guidance  and 
approach  for  consideration  and  evaluation 
of  ADP  internal  controls; 

(4)  responsible  officials  at  all  levels  of  the 
organization  effectively  perform  their  quality 
assurance  responsibilities  [throughout  all 
programs] ; 

(5)  an  inventory  of  accounting  systems  is  promptly 
completed; 

(6)  appropriate  manual  and  ADP  accounting  systems 
controls  are  tested  in  operation  as  an  integral 
part  of  the  evaluation  process  [44:3], 


These  findings  suggest  that  Automatic  Data  Processing  (ADP) 
will  receive  more  emphasis  from  the  GAO  and  the  AFAA  in 


future  years.  The  Air  Force  has  room  for  improvement  in 
areas  such  as  training  as  suggested  in  the  PMCS  papers. 

Other  GAO  reports  cited  problems  such  as  the  lack  of 
a  formal  organizational  plan  to  implement  the  internal 
control  program  (44). 

Summary 

Standards  are  needed  to  evaluate  any  system  of 
management  control.  The  GAO  standards  are  similar  to  their 
civilian  counterparts.  Independence  is  the  most  frequently 
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violated  standard  when  internal  auditing  of  internal 
controls  is  performed. 

A  good  system  of  internal  controls  is  built  into  the 
management  schema.  It  guides  managers  in  performance  of 
their  jobs.  It  protects  resources  and  prevents  "material 
weaknesses"  in  the  system.  If  weaknesses  or  poor  resource 
management  techniques  exist,  the  system  of  internal 
controls  will  identify  them  and  provide  guidelines  for 
correction. 

The  system  of  internal  controls  should  not  be  so 
complex  as  to  defeat  its  own  purpose  and  be  unmanageable. 
For  this  reason  also,  its  benefits  must  outweigh  the  "cost" 
of  its  implementation  and  use.  The  system  is  not  one  of 
absolute  control,  but  minimization  of  risk. 

The  Air  Force  system  of  Internal  Control  Reviews  has 

I 

been  extremely  complex  since  its  beginning  in  FY83.  Placed 
in  the  Cost  and  Management  Analysis  Branch,  training  was 
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inadequate  to  immediately  reach  the  objectives  of  the  ICR 
program.  Program  guidance  was  often  received  late  in  the 
fiscal  year  and  was  frequently  difficult  to  comprehend 
because  of  its  abundance. 

Training  is  the  number  one  concern  of  many  sources. 

If  the  personnel  administering  and  performing  the  program 
are  not  well  trained,  the  program  will  not  succeed. 

Private  industry  also  feels  the  need  for  more  training  in 
the  internal  management  control  area.  If  untrained 
personnel  .must  spend  a  great  deal  of  time  trying  to  learn 
the  ICR  program,  there  will  be  an  additional  strain  on 
manning  in  areas  that  already  feel  they  are  burdened. 

All  branches  of  the  service  complained  that  their 
guidance  was  very  lengthy  during  the  first  years  of  their 
Internal  Control  Programs.  Air  Force  guidance  needs  to  be 
streamlined.  The  guidance  should  be  more  consistent 
between  major  air  commands  and  there  should  be  information 
sharing.  Although  many  managers  are  concerned  about 
"airing  dirty  laundry,"  the  literature  showed  that  past 
attempts  by  other  government  agencies  has  been  helpful. 

The  GAO  recommended  the  sharing  of  information  between 
government  agencies.  Air  Force  Logistics  Command  is  the 
only  command  to  say  that  thoy  are  doing  so.  The  Army 
believes  automation  is  the  key  to  this  purpose. 

A  new  regulation  was  called  for  during  the  Air  Force 
Audit  Agency’s  review  of  the  first  year  implementation  of 
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tho  lCIi  progrum  l>y  Lho  Air  Forco.  Aft.or  three  and  one-half 
years,  the  draft  of  the  new  regulation  has  only  recently 
been  received  in  the  field  at  the  major  air  commands. 

The  Navy  and  Army  locate  their  Internal  Control 
Programs  under  the  Comptroller,  much  as  the  Air  Force. 

Only  the  Air  Force  seems  to  have  fragmented  its 
administration  to  several  directorates. 

Some  sources  believe  that  there  is  a  conflict  of 
interest  when  a  functional  manager  reviews  his  or  her  own 
area  and  that  ICRs  are  duplication  of  effort  with  the 
existing  self-inspection  program.  Some  sources  also 
believe  that  the  Cost  Analysis  Branch  is  not  a  good 
location  for  placing  the  responsibility  of  program 
monitoring  and  administration,  especially  since  ACC  does 
not  administer  the  entire  program. 


III.  METHODOLOGY 


Introduction 

This  chapter  provides  an  overview  of  the  procedures 
that  were  used  to  address  the  research  problem.  The 
empirical  method  used  to  obtain  information  was  a  pilot 
interview.  Also  provided  in  this  chapter  is  a  discussion 
of  the  purpose  and  intent  of  each  question  used  in  the 
pilot  interview. 
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Outline  of  the  Approach 

The  general  method  used  in  this  research  is  divided 
into  four  major  steps: 

1.  Review  of  the  existing  literature  on  Department  of 
Defense  (DOD)  Internal  Control  Systems,  particularly  the 
Air  Force  systems. 

2.  Data  were  collected  on  the  Internal  Control 

Reviews  (ICRs)  performed  in  the  past.  A  carefully 

developed  pilot  interview  of  personnel  in  selected  ACC 

functions  within  the  Continental  United  States  (CONUS)  and 

current  students  at  the  Air  Force  Institute  of  Technology 

(AFIT)  who  recently  left  such  positions  was  another  vehicle 

for  obtaining  information  on  past  performance  data  within 

the  ICR  program  and  for  obtaining  suggestions  from  base 

level  and  command  personnel.  Most  Air  Force  major  commands 
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required  manhour  and  performance  data  be  gathered  for  each 
office  and  forwarded  at  the  close  of  the  fiscal  year, 


therefore  these  data  were  available  i'or  at  least  tl»o  last 
two  years. 

3.  Analysis  of  the  data  was  performed  using  the 
Statistical  Package  for  the  Social  Sciences  (SPSSX),  tenth 
revision,  computer  programs  on  the  VAX  11/785  computer  using 
the  UNIX  operating  system.  The  results  of  this  study, 
combined  with  earlier  research,  addressed  the  following 
questions : 

a)  Is  there  a  better  way  to  run  the  ICR  program? 

s 

b)  Are  base  personnel  managing  the  program  in  accor¬ 
dance  with  directives?  Is  it  possible  to  do  so? 

c)  Does  duplication  of  effort  cause  a  loss  of 
productivity  and  incur  costs? 

d)  Can  the  self -inspection  program  successfully 
incorporate  the  ICR  program  to  the  advantage  of 
both?  Or  should  the  self -inspection  program  be 
incorporated  into  the  ICR  program? 

4.  Compilation  of  the  results  of  data  collection  and 
analysis  was  completed,  and  interpretation  accomplished. 

The  Pilot  Interview 

The  standard  questions  (Appendix  D)  were  asked  in 
person  or  by  telephone  (depending  on  geographic  location) 
of  Cost  and  Management  Analysis,  Cost  Analysis  (ACM/ACC) 
office  personnel  who  are  the  Internal  Control  Review  (ICR) 
monitors  for  their  bases  or  commands.  Analysts  were  inter¬ 
viewed  within  each  Major  Air  Command  (MAJCOM)  in  the  CONUS, 
two  at  MAJCOM  ACC  directorates,  and  one  at  a  Special 
Operating  Location,  office  performing  as  the  ICR  Office  of 


Primary  Responsibility  (OPR).  Several  former  ICR  monitors, 
newly  arrived  Air  Force  Institute  of  Technology  Graduate 
Cost  Analysis  students,  were  selected  to  complete  a  sample 
total  of  31  subjects. 

Selection  of  a  base  Cost  Analysis  Branch  for  interview 
was  determined  by  size  of  its  population  and  as  a  represen¬ 
tative  function  for  its  command,  e.g.  for  SAC,  at  least  one 
missile  base  and  one  flying  base  were  selected.  Table  I 
presents  specific  characteristics  of  the  measured  attri- 
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butes  of  each  question  in  the  interview.  The  reader  should 
note  that  some  of  the  questions  serve  dual  purposes,  that 
is,  they  provide  information  in  more  than  one  area  of 
interest. 

The  questions,  most  of  which  are  based  on  a  Likert 
scale  (88),  are  divided  into  major  topic  areas,  a  brief 
discussion  of  each  topic  and  of  each  question’s  thrust 
follows . 

Rgli»biJ.itx 

Reliability  measures  the  degree  to  which  a  measure  (in 
this  case  a  scale)  is  free  of  random  variance,  e.g.,  the 
degree  to  which  the  scale  (the  measuring  instrument)  is 
free  from  random  error  and  is  normally  read  as  a 
percentage.  This  measure  of  internal  consistency  is 
considered  excellent  above  .9  (90%  reliability)  and 
acceptable  above  .6  (60%  reliability)  (88). 


TABLE  I 


Key  to  Internal  Control  Review  Interview 

Area;  Question  Reliability 

No.:  Percentage: 

A.  Demographic /Background  Data 


Amount  of  Services  Provided 

to 

Cl) 

30 

N/A 

Amount  of  Assistance 

Requested 

27,  28, 

29 

.6270 

MAJCOM 

6 

N/A 

Rank  or  Grade 

37 

N/A 

Base  Population  Served 

38 

N/A 

B.  Organization  and  Independence 


Conflict  of  Interest 

31, 

32 

.7923 

Independence 

9,  10,  11, 

26 

.6375 

C.  Level  of  ICR  Skills 


Experience 

2, 

20 

.4648 

Training 

33, 

34 

N/A 

D.  Internal  Control  Review  Performance 


Compliance 

10,  14,  16, 

17, 

18 

.6381 

Cooperation 

4 

,  5, 

12 

-.1684 

Scheduling,  Planning, 

and  Control 

6,  7 

,  8 

.5547 

Duplication  of  Effort 

19, 

24 

.4856 

Attitude 

1, 

15, 

25 

.5101 

Understanding 

22, 

23, 

24 

-.7550 

Impediment  to  proper 

completion  of  ICR’s 

39 

N/A 

Reporting  Procedures 

ICR  Process 

8 

Final  Report  Content 

18, 

31 

.  1240 

Documentation 

10, 

16, 

32 

.2558 

Degree  of  Acceptance 

12, 

17, 

21 

-.0119 

Recommendations 

Information  Required 

13 

N/A 

Realignment 

19,26 

.2843 

Assistance  Needed 

34 

N/A 

Open  suggestions 

35 

N/A 

53 
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a.  Demographic/Background  Information  (33:50-52): 

The  information  covered  under  this  topic  serves 

two  purposes:  to  separate  the  data  by  specific  groups  and 
to  allow  differential  analysis  based  on  the  size  of  the 
installation,  and  amount  of  ICR  services  provided.  Since 
all  questions  in  this  grouping  are  based  on  a  Likert  scale 
measurement  techniques,  and  due  to  the  straightforward 
nature  in  which  the  questions  were  asked,  no  bias  of 
responses  is  expected. 
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Questions  2,  3,  and  4  assess  familiarity  with  the 
program,  based  on  the  number  of  reviews  an  office  has 
conducted  and  the  degree  to  which  this  information  is 
disseminated. 

Questions  27,  28,  29,  and  30,  ask  how  frequently 
Functional  Area  Managers  request  advice  from  the  Cost 
Analysis  Branch  ICR  monitor. 

Questions  36,  37,  and  38,  request  demographic 
information. 

b.  Organization  and  Independence  (33:53-56;  1:39): 

Evidence  suggests  the  placement  of  Internal  Control 

Reviews  within  the  Comptroller  Division  may  affect  its 
ability  to  perform  its  mission.  Auditing  in  the  Air  Force 
is  usually  performed  by  the  Air  Force  Audit  Agency  (AFAA) 
and  findings  are  considered  on  a  par  with  major  inspection 
results--discrepancies  are  black  marks  on  a  unit’s  record. 
Since  separation  of  duties  is  one  of  the  prerequisites  for 


internal  control,  this  section  of  questions  also  looked  at 
monitors’  perceptions  as  to  violation  of  this  standard. 

Questions  31  and  32  look  at  the  way  ICRs  are  viewed 
by  the  monitor.  Does  the  monitor  feel  he  or  she  can  openly 
work  with  the  Functional  Area  Managers  without  reprisal,  or 
does  the  "black  hat"  image  of  "inspectors"  fall  on  the 
monitor  and  prevent  open  working  relationships? 

Questions  9,  10,  and  11  look  at  the  perceived  imparti¬ 
ality  of  the  monitors  and  if  the  Functional  Area  Managers 

t 

felt  they  were  performing  an  internal  audit  that  was 
independent  of  their  regular  duty  performance.  This  ques¬ 
tion  arose  because  ACC/ACM  is  frequently  called  upon  to 
perform  special  studies  called  Management  Assistance  Ser¬ 
vices.  These  studies  are  requested  by  a  manager  at  any 
level  and  are  designed  to  aid  that  manager  in  solving  a 
problem.  If  the  recently  solved  problem  was  one  related  to 
an  ICR  topic,  there  could  be  a  conflict  of  interest.  Fur¬ 
ther,  if  the  managers  felt  they  were  "foxes  guarding  the 
hen  house,"  it  would  have  been  difficult  for  them  to  judge 
their  own  programs  objectively.  "Independence  is  generally 
considered  a  matter  of  ethics,  but  in  truth,  the  quality  of 
that  independence  is  an  important  central  concept  within 
[public  sector]  auditing"  (33:53).  Questions  9  and  10 


called  for  an  opinion  to  be  formed  concerning  the  amount  of 

\ 

manning  and  adequacy  of  an  audit  trail,  which  may  have 
invoked  some  bias.  However,  most  experienced  personnel 
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would  be  unbiased  in  acknowledging  that  other  duties  were 
being  disregarded  in  order  to  complete  ICRs  and,  based  on 
AFAA  guidelines,  could  give  an  objective  judgment  on 
adequacy  of  documentation. 

Question  26  investigates  the  concept  of  independence. ' 
Is  the  monitor  independent,  or  does  he  or  she  feel  only  the 
AFAA  is  afforded  the  appropriate  degree  of  independence  to 
provide  the  Functional  Area  Managers  with  guidance? 

c.  Level  of  ICR  Skills  (33:56-^9;  1:39): 

Another  standard  of  internal  control  pertains  to 
"competent  personnel"  and  states  that  "key  personnel  have 
high  standards  of  integrity  and  are  competent,  by 
education,  training,  or  experience,  to  accomplish  their 
assigned  duties"  (Appendix  D) .  In  order  to  accomplish  the 
objectives  of  the  GAO,  personnel  performing  ICRs  should  fit 
this  description.  These  questions  requested  information  on 
qualifications,  experience,  and  training  received  by  the 
current  ICR  monitor.  Again,  due  to  the  straightforward 
nature  of  the  questions,  no  bias  is  expected  in  the  answers 
to  these  questions. 

Question  2,  used  earlier  in  another  context,  was 
designed  to  shed  further  light  on  the  extent  of  experience 
available  to  Functional  Area  Managers  (FAMs). 

Question  20  looked  at  the  experience  base  of  the 
individual  monitor,  thereby  providing  a  view  not  only  into 


the  recommendations,  but  also  into  the  experience  base  the 
monitor  used  in  answering  all  other  survey  questions. 

Question  33,  asked  for  the  amount  of  training  received 
by  the  monitor  (23*.  10).  This  question  allowed  a 
perspective  to  be  placed  on  Question  20  as  well  as  give  a 
basis  to  judge  performance  and  attitudes.  If  a  recently 
selected  ICR  monitor  received  more  training  than  a  long 
time  monitor,  commands  may  be  expending  more  resources  on 

prevention  of  reporting  errors  and  ensuring  program  under- 
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standing  than  in  the  past.  If  the  long  time  monitor  feels 
training  received  was  or  is  inadequate,  commands  have  not 
caught  up  with  guidance  or  may  not  be  able  to  do  so . 

Question  34  evaluated  a  monitor’s  need3  and  desires 
for  more  training  to  help  them  do  their  jobs.  It  also  was 
designed  to  see  if  a  better  formal  training  program  might 
be  perceived  as  desirable  (23:10). 

d.  Internal  Control  Review  Performance  (33:59-62; 

1:39)  : 

Compliance  with  legislation  and  AFR  170-22,  adequate 
control,  and  flexibility  are  considered  "essential  ingre¬ 
dients"  for  an  effective  internal  audit  unit  (33:59).  The 
questions  in  this  area  were  designed  to  look  at  compliance 
with  GAO  standards  and  their  specific  application  in  the 
Air  Force  ICR  program.  Also,  how  well  did  the  Functional 
Area  Managers  cooperate  with  the  base  monitor  in  completion 
of  ICRs,  what  attitude  affected  the  cooperation  efforts  and 


are  ICRs  viewed  as  belonging  not  only  in  ACM/  ACC,  but  also 
as  a  separate  program?  Once  again,  the  Likert  scaling 
technique  was  employed,  and,  although  some  opinion  is 
called  for,  most  questions  are  straightforward  and  MAJCOM 
feedback  to  a  base  on  program  compliance  would  forestall 
biased  answers. 

In  the  area  of  compliance  with  legislation  and  regula¬ 
tions,  Question  10  asked  for  compliance  with  the  audit 
trail  provisions,  while  Question  14  asked  for  an  opinion 
which  touches  the  heart  of  internal  controls--integrity . 
This  question  is  a  key  one,  for  many  of  the  Functional  Area 
Managers  in  this  author’s  experience  asked  about  this 
issue.  During  the  ICR  training  sessions  she  led,  managers 
asked  if  they  could  "bluff  their  way  through”  a  review. 

The  AFAA’s  review  guidelines  made  it  clear  that  they  would 
be  looking  for  just  that  type  of  situation.  The  ICR 
monitor  at  each  wing  would  be  "tuned-in"  to  similar 
reactions,  and  through  a  spot  review  mentioned  in  Question 
32,  a  discussion  prior  to  forwarding  an  ICR  to  MAJCOM,  and 
a  strong  follow-up  program  for  identified  weaknesses 
(Question  8),  would  have  a  very  objective  view  of  the 
performance  of  ICRs. 

Questions  16,  17,  and  18  were  straightforward 
questions  concerning  support  of  the  program  by  commanders. 
The  measurement  of  this  support  is  necessary  to  evaluate 
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meeting  the  GAO  standards  of  "supervision"  and  "reasonable 
assurance"  because  commanders  must  ensure  that  the  cost  of 
internal  controls  should  not  exceed  the  benefits  derived 
therefrom,  and  that  the  benefits  consist  of  reductions  in 
the  risks  of  failing  to  achieve  the  stated  objectives 
(32:12-13). 

The  next  series  of  questions  looked  at  cooperation 
and  overall  management  of  ICRs.  Question  4  asked  if  all 
scheduled  ICRs  were  completed  on  time,  the  difference 
between  the  number  completed  on  time  and  the  number 
completed  in  Question  3  gave  a  good  indication  of  whether 
or  not  Functional  Area  Managers  not  only  cooperated  with 
monitors,  but  planned,  scheduled,  and  controlled  their  ICR 
process.  It  might  also  indicate  whether  or  not  a  MAJCOM 
provided  adequate  lead  time  to  perform  an  ICR. 

From  Question  5,  if  Functional  Area  Managers  do 
not  consider  that  ICRs  are  their  responsibility,  it  could 
result  in  the  percentage  of  ICRs  completed  on  time 
(Question  4)  being  low. 

Similarly,  if  ACC/ACM  monitors  "drag  their  feet” 
because  they  feel  ICRs  are  an  inappropriate  burden  for 
their  offices,  Question  12,  it  might  affect  the  answers  to 
Question  4  concerning  the  attitude  of  the  Functional  Area 
Managers . 

I 

Questions  6,  7,  and  8  were  a  straightforward  look  at  a 
formalization  of  a  local  ICR  implementation  plan.  A  well 


organized  program  would  tend  to  be  on  time,  gain  more 
command  support,  and  be  better  implemented. 

Is  there  a  duplication  of  effort  between  programs? 
Question  19  is  an  in-depth  look  at  placement  of  the  Inter¬ 
nal  Control  Review  Program.  If  a  monitor  is  satisfied, 
only  the  first  part  need  be  answered.  The  literature 
review  revealed  that  many  monitors  have  good  ideas  for 
improvement.  Question  19  invited  comments  as  to  how  the 

suggested  improvements  will  affect  an  ACM/ACC  function, 

/ 

while  Question  24  is  a  cross-check  of  Question  19. 

Questions  15  and  25,  asked  questions  concerning  the 
monitor’s  attitude  toward  the  program.  Question  15  asked 
for  a  personal  evaluation  as  to  the  value  of  the  subjects 
reviewed  by  ICRs.  This  answer  relates  to  other  areas  as 
well,  such  as  training,  understanding,  and  performance. 

Question  25  sought  to  learn  if  monitors  believe 
compliance  is  rewarded  or  non-compliance  noted.  One  of  the 
tenets  of  management  is  control;  without  feedback  managers 
tend  to  lack  control. 

Questions  22,  23,  and  24,  were  designed  to  evaluate 

how  well  monitors  understand  the  thrust  of  the  program  and 

if  they  found  the  ICR  program  to  be  valuable  in  resource 

management.  All  three  questions  were  straightforward,  but 

do  leave  room  for  some  bias  based  on  the  wording  within  the 

» 

questions.  The  results  will  be  checked  carefully  with 
Question  39. 
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Question  39  was  intended  to  ascertain  information 
concerning  the  cause  or  causes  of  either  the  FAM’s  or  the 
Cost  Analyst’s  inability  to  comply  with  the  Internal 
Control  Review  Program.  Due  to  its  subjectivity,  there  may 
be  some  bias  in  these  answers  due  to  the  "open-forum”  type^ 
of  answer  sought.  Much  valuable  insight,  however,  may  be 
gained  into  perceptions  of  what  causes  non-compliance  and 
non-performance . 

e.  Reporting  Procedures  (33:62-66;  1:39): 

The  ICR  reporting  procedures  are  the  only  means 
prior  to  an  AFAA  audit  that  bases  have  to  "communicate 
their  findings  to  management"  (33:62).  Furthermore,  they 
should  be  the  means  by  which  recommended  improvements  in 
various  programs  and  regulations  reach  the  proper  level 
quickly.  Questions  under  this  topic  were  concerned  with 
how  well  AFR  170-22  and  command  guidelines  are  met. 
Questions  in  this  area  also  used  a  Likert  scale  to  allow 
for  categorization  of  information. 

Question  8  requested  a  yes/no  response  regarding  a 
recent  additional  review  requirement.  The  first  year  or  so 
of  the  program  formal  follow-up  procedures  were  not 
required.  ACC  became  the  monitor  and  reviewer  of  follow-up 
procedures  later.  Formal  schedules  for  correction  were 
required  to  be  coordinated  between  Functional  Area  Managers 
and  the  ICR  monitor. 


Questions  18  and  31,  previously  discussed,  were  also 
used  to  determine  if  final  reports  are  in  compliance  with 
existing  requirements.  While  Questions  10,  16,  and  32, 
also  discussed  above,  are  a  verification  of  compliance  with 
•  documentation  requirements . 

To  determine  if  the  ICR  program  is  readily  accepted,  * 
Questions  12,  17,  and  21,  discussed  previously,  measure  a 
monitor’s  feelings  about  where  the  ICR  program  is  going  and 
his  or  her  perception  of  its  effectiveness, 
f.  Recommendations: 

The  most  important  section  is  also  the  most 
subjective  one.  The  questions  here  were  all  designed  to 
find  out  what  monitors  suggest  may  be  done  to  improve  a 
program  that  is  not  meeting  objectives.  Based  on  their 
experience  and  insight,  how  would  they  improve,  change, 
etc?  There  may  be  personal  biases  involved  here,  but  many 
sound  recommendations  were  expected  and  those  not  feasible 
were  discarded.  If  training  is  inadequate,  it  could  cause 
a  pyramid  effect  to  damage  other  levels  of  the  program. 

The  questions  in  this  section  were  carefully  analyzed  and 
paraphrased  to  protect  the  anonymity  of  the  suggestor. 

The  first,  Question  13,  looked  at  the  process  of 
"crossfeed"  of  inspection-type  items  between  bases. 
Inspection  discrepancies  are  forwarded  prior  to  MEIs  and 
ORIs.  Why  should  not  a  command's  ICR  findings  and  methods 
be  shared  as  a  "lessons  learned"  concept  to  be  passed  on 


within  or  even  across  commands?  A  new  ICR  monitor  could 


increase  his  or  her  knowledge  if  a  continuity  folder, 
similar  to  those  used  throughout  the  Air  Force,  were 
available. 

Questions  19  and  26  looked  at  the  idea  of  realigning 
the  ICR  program.  A  yes/no  response  precedes  an  in-depth 
appraisal  and  subjective  suggestion  area  for  where  the 
monitors  feel  ICRs  fit. 

Question  34  asks  if  monitors  need  any  additional 
training  to  extend  their  knowledge  of  the  program  and, 
therefore,  their  performance. 

Answers  to  Question  35  were  entirely  subjective.  For 
example,  the  ICR  monitor  was  invited  to  have  a  brainstorm¬ 
ing  session  or  air  ideas  concerning  suggested  improvements 
gathered  over  the  months  of  working  with  the  program. 

Analysis  of  the  Data 

The  statistical  Package  for  the  Social  Sciences 
(SPSSX),  tenth  version,  on  a  VAX  11/785  computer,  was 
employed  to  compute  the  needed  statistics  (73).  Results 
such  as  the  mean  number  of  hours  spent  to  finalize  an  ICR, 
average  number  of  reviews  performed  per  office  per  fiscal 
year  per  command,  and  the  number  of  ICRs  late  to  MAJCOM 
were  calculated.  Series  of  correlations  were  run  between 
the  questions  as  grouped  in  Table  I  to  determine  how 
answers  interrelated.  Reliability  was  estimated  and  is 
reported  with  the  items  entering  into  each  scale  in  Table 


I .  Percentages  of  responses  by  question  were  obtained  by 
using  the  "CROSSTABS"  option. 


Testing  the  Results  of  Analysis 

Statistical  tests  were  completed  to  check  for 
differences  between  two  groups,  those  who  believed  the 
program  should  be  changed  and  those  who  did  not.  In  only 
one  area,  that  of  installation  population,  did  the  two 
groups  differ  significantly.  Personnel  assigned  to  bases 
of  between  6,000  and  10,000  personnel'  tended  to  believe  the 
program  should  be  changed.  Personnel  at  smaller  bases  or 
larger  bases  tended  to  be  more  satisfied  with  the  current 
ICR  program. 

Summary 

This  chapter  outlined  the  methods  used  to  complete 
research  for  this  thesis.  A  structured  interview  was 
administered  to  a  pilot  sample  from  commands  in  the 
continental  United  States  and  the  Air  Force  Institute  of 
Technology. 

The  SPSSX  computer  programs  were  run  on  a  VAX  11/785 
(UNIX)  to  provide  data  for  analysis.  Open-ended  question 
responses  concerning  the  same  question  were  grouped  by  type 
of  response  and  are  reported  in  the  next  chapter. 

Conclusions  aybout  the  data  and  recommendations  for 
improving  the  ICR  program  are  found  in  Chapter  V. 


IV.  FINDINGS 


Introduction 

Of  the  31  personnel  responding,  18  were  able  to  pro¬ 
vide  performance  data  from  Fiscal  Year  1983,  23  had  records 
from  1984,  and  all  31  had  data  from  1985  and  1986.  The 
three  command  level  answers  reflected  hours  reviewing 
Internal  Control  Reviews  (ICRs)  forwarded  to  them  by  their 
bases  and  vulnerability  assessments  performed.  These  hours 

are  not  included  in  the  calculations  below  because  commands 
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do  not  actually  perform  the  Internal  Control  Reviews. 
Commands  are  responsible  for  overall  program  administra¬ 
tion,  summarization  of  base  data,  the  command  year-end 
certification,  and  dissemination  of  guidance/information. 
These  actions  still  expend  time  and  money,  but  at  a 
different  rate  than  used  by  the  base  ICR  monitors. 

When  reviewing  the  following  statistics,  a  copy  of  the 
questions  (Appendix  D)  should  be  helpful  to  the  reader. 

Question  Responses 

Amount  of  Service  Provided  -  Questions  2.  3.  and  4. 

In  Fiscal  Year  1983,  the  15  bases  with  records  spent  an 
average  of  181.5  hours  per  office  (usually  performed  by 
one  analyst  and  one  secretary /administrative  assistant) 
performing  an  average  of  14.5  ICRs  per  base.  Several  Cost 
and  Management  Branches  also  worked  with  the  Accounting  and 
Finance  Branch  (ACF)  that  year  to  perform  an  additional 


number  of  reviews.  The  hours  ranged  from  a  low  of  37  at 
one  base  to  a  high  of  804,  but  most  offices  registered 
between  100  and  200  hours  each.  The  number  of  ICRs 
completed  ranged  from  2  to  a  high  of  30  with  the  majority 
logging  between  10  and  20  ICRs  each. 

In  Fiscal  Year  1984,  20  bases  performed  an  average  of - 
180.6  hours  completing  an  average  of  10.1  ICRs  per  base. 
Again,  the  Cost  Branch  worked  with  ACF  to  complete  as  many 
as  seven  ICRs  at  one  base.  The  range  of  hours  went  from 
a  low  of  8  to  a  high  of  1803,  with  th'e  majority  (16) 
reporting  less  than  110  hours  each.  The  number  of  ICRs 
completed  ranged  from  none  to  20  fairly  evenly  distributed 
through  the  scale. 

In  Fiscal  Year  1984,  the  28  reporting  bases  spent  a 
lower  average  of  101.4  hours  each  performing  an  average  of 
7.3  ICRs  per  base.  There  were  8  additional  "compliance” 
reviews  and  many  Cost  Branches  assisted  with  additional  ACF 
area  ICRs.  The  range  of  hours  went  from  "less  than  an 
hour"  to  828,  with  most  offices  (25)  recording  less  than 
100  hours  per  base.  The  range  of  ICRs  completed  went  from 
none  to  14. 

In  Fiscal  Year  1986,  including  estimated  hours  for 
completion  of  the  end  of  year  commander’s  certification, 
the  bases  estimate  they  will  spend  an  average  of  only  52.8 
hours  completing  only  1.5  per  base,  while  assisting  ACF 
with  at  least  2  more  average  per  base  and  several 


vulnerability  assessments  for  commanders  desiring  to 
perform  self -initiated  ICRs  next  fiscal  year.  The  range  of 
hours  is  estimated  from  a  low  of  1  to  a  high  of  300,  with 
the  number  of  ICRs  being  completed  ranging  from  none  to  a 
high  of  6  (including  several  self-initiated) .  During  the 
fiscal  year,  it  was  estimated  that  each  Cost  Branch  will  be 
involved  in  from  1  to  6  follow-ups  on  previous  ICRs.  They 
will  spend  most  of  their  ICR  hours  completing  the  end  of 
year  reports  and  training  new  Functional  Area  Managers  how 
to  perform  ICRs.  At  some  locations  Accounting  and  Finance 
does  not  consult  with  the  Cost  Analysis  Branches  in  ICR 
review  procedures,  nor  are  they  required  to.  At  some  bases 
they  work  closely  together,  but  the  ICRs  are  directed  from 
different  sources  as  mentioned  in  Chapter  2. 

Training  -  Questions  33  and  34.  Mixed  responses  were 
received  as  to  the  degree  of  training  received  as  the  ICR 
monitor.  Seven  (22.6%)  felt  that  they  had  received  exten¬ 
sive  training  to  prepare  them  for  their  ICR  monitor  duties. 
Eight  (25.8%)  stated  that  the  training  was  adequate  but 
could  have  been  better.  Eight  more  (25.8%)  said  they  re¬ 
ceived  minimum  training  to  assume  their  duties,  while  the 
last  8  (25.8%)  said  they  received  no  training  to  speak  of 
and  were  mostly  self-taught. 

The  majority  of  those  who  felt  that  they  had  received 
» 

extensive  training  were  in  AFLC  (5)  while  half  of  those  who 


stated  they  had  received  no  training  (8)  were  in  SAC  (4). 
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Many  monitors  chose  to  further  amplify  their  answers. 


Some  stated  that  the  original  guidance  received  was  inade¬ 


quate  and  received  too  late  in  a  fiscal  year  to  be  of 


value,  especially  at  the  beginning  of  the  program  in  FY83. 


Frequent  changes  were  made  to  the  program  and  confused  FAMs 


did  not  bring  them  into  the  loop  during  a  time  when  they 


were  required  to  closely  monitor  the  program.  Since  they 


received  their  Air  Force  and  Command  guidance  and  training 


packages  late,  they  were  often  embarrassed  in  front  of  the 


Functional  Area  Managers  (FAMs)  whom 'they  had  to  train. 


A  number  of  monitors  commented  on  the  limited 


usefulness  of  the  327  page  training  course  packages 


mentioned  earlier  in  this  research.  Some  monitors  felt 


that  it  "sat  on  their  shelves  gathering  dust"  because  no 


one  had  the  time  to  really  read,  comprehend,  and  employ 


it.  AFLC  personnel  tended  to  feel  it  was  a  "great"  course, 


but  really  intended  for  command  use  as  it  is  quite  lengthy. 


Only  a  few  felt  the  course  was  "super"  and  really  used  it 


when  training  other  managers  or  when  spot-checking  documen¬ 


tation.  These  few  stated  they  had  been  given  explicit 


instructions  and  training  on  what  parts  of  the  course  they 


should  know  and  use  and  what  volumes  were  for  the  FAMs  use. 


Only  three  of  the  31  respondents  (9.7%)  felt 


sufficiently  trained  to  the  point  they  did  not  need  further 


training  as  asked 'in  Question  34  (see  Table  II  below).  Ten 


persons  felt  that  they  would  benefit  from  training  in  only 


one  area  and  six  felt  they  could  benefit  from  training  in 
two  listed  areas.  Six  monitors  felt  that  three  of  the 
areas  cited  would  benefit  them,  and  two  cited  four  areas 
they  would  like  to  learn  more  about.  Three  persons  felt 
that  there  were  five  areas  from  which  they  could  gain 
insight,  and  only  one  felt  all  seven  would  be  valuable.  A 
breakdown  of  how  the  numbers  of  responses  went  with  each 
area  is  above  in  Table  II.  The  most  common  response 
patterns  included  items  number  1,  4,  and  7,  or  items  4,  6, 
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and  7  together.  Of  the  three  personnel  not  desiring 
further  training,  one  had  been  stationed  at  a  higher 
command  level  working  as  a  command  monitor,  and  one  had 
prior  audit  agency  experience. 

Table  II 

Training  Areas  of  Benefit 

Response  #  #  Desiring 

more  training 


1. 

Auditing  Procedures  and  standards 

16 

2. 

Accounting  system  review 

6 

3. 

Automatic  Data  Processing  Controls 

8 

4. 

Knowledge  of  applicable  law,  AF  and 
command  regulations  and  policies 

11 

5. 

Resource  Management  training 

6 

6. 

Identifying  Air  Force  ICR  program 
objectives 

8 

7. 

Necessity  for  the  Internal  Control 
Program 

15 

0. 

No  further  training  required 

3 
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As  discussed  in  Chapter  2,  training  is  a  critical 
area.  GAO  listed  training  as  a  "Number  1"  priority  in 
their  list  to  the  Secretary  of  the  Air  Force  (44:151). 
Forsythe  likewise  stated  that  it  was  the  Army’s  first  major 
problem  area  (34:14). 

Questions  19  and  24.  In  Question  24,  monitors  were 
asked  to  indicate  their  agreement  with  the  statement  thtt 
ICRs  are  “just  another  self -inspection. "  Many  monitors  had 
already  responded  that  FAMs  felt  ICRs  were  just  another 
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self-inspection  during  their  comments  while  answering 
Question  1.  A  number  of  monitors  had  also  previously 
answered  in  the  affirmative  when  answering  Question  19. 
Eleven  monitors  (35.5%)  agreed  strongly  that  ICRs  were  a 
form  of  3elf -inspection  and  12  (38.7%)  agreed  somewhat. 

Five  (16.1%)  felt  they  could  agree  "a  little"  that  it  is 
another  self-inspection,  but  that  it  had  "more  going  for 
it"  than  the  often  "pencil  whipped”  self-inspection 
process.  Three  (9.8%)  monitors  felt  they  were  not  related 
programs  at  all  because  ICRs  go  beyond  the  basic  self- 
inspection  concept. 

Question  19.  Monitors  were  asked  if  ICRs  could  be 
incorporated  into  any  other  program.  A  large  number  (26  or 
83.9%)  said  emphatically  "yes,”  only  3  (9.7%)  said  "no," 
with  2  (6.5%)  unsure. 

I 

Most  monitors  felt  that  self -inspections  were  the  logi¬ 
cal  place  to  evaluate  management  controls  in  the  form  of 
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ICRs.  Increased  accuracy,  reduced  reporting  requirements 
and  recapture  of  Cost  Branch  duty  hours  were  three  reasons 
cited  for  incorporations  with  other  programs .  Some 
monitors  felt  incorporating  the  two  programs  would  reduce 
.  the  temptation  for  "pencil  whipping"  and  add  quality  to  a 
flagging  program.  Many  programs  when  not  emphasized  seem  * 
to  fall  by  the  wayside;  this  would  revitalize  and  re¬ 
emphasize  the  importance  of  internal  management  controls. 

In-depth  analysis,  evaluation  and  testing  of  processes 
and  problems  are  some  of  the  objectives  of  self-inspection 
but  are  frequently  ignored  to  speed  the  process.  When 
doing  ICRs,  managers  are  afraid  to  do  in-depth  analysis  for 
fear  of  airing  "dirty  laundry"  and  opening  themselves  up 
for  later  criticism.  If  the  two  programs  were  incorpo¬ 
rated,  performing  ICRs  would  become  part  of  routine 
management  procedures.  The  "monkey"  would  be  off  the  back 
of  Cost  Analysis,  reduce  the  "black  hat"  image,  and  place 
the  vice  commander  of  a  base  or  wing  in  control.  This 
improves  management  support,  visibility,  and  awareness  of 
the  ICR  program  in  general. 

One  monitor  felt  that  removing  ICRs  from  the  Cost 
Branch  loop  into  either  self -inspection  or  the  IG  circuit 
would  allow  Cost  A:\alysts  to  do  "cost  work."  The  recent 
name  change,  from  Cost  and  Management  Analysis  to  Cost 
Analysis,  should  not  be  in  vain.  Analysts  are  not  and 
should  not  be  experts  in  every  field.  Analysts  see  them- 
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selves  training  FAMs  and  checking  paper — a  violation  of  the 
span  of  control  concept  since  Cost  Analysts  can  not  affect 
another  area’s  personnel  evaluations. 

Sixteen  of  the  people  who  answered  "yes"  to  incorpora¬ 
tion  also  felt  that  manhours  could  be  regained  for  Cost 
Branch  work,  for  51.6%  of  the  total.  Eight  (25.8%)  felt 
that  as  the  program  stands  now,  no  manhours  could  be  saved, 
two  (6.5%)  felt  that  it  was  a  good  idea,  but  no  manhours 
would  be  saved  because  program  administration  will  never  go 
away.  Three  (16.1%)  monitors  didn’t  know  if  hours  would 
be  saved  or  not. 

The  number  of  manhours  expected  to  be  saved  per  fiscal 
year  ranged  from  none  (10  or  32.3%),  as  mentioned  above,  to 
"less  than  15"  (9  or  29.0%),  to  "16  to  30  hours"  (2  or 
6.5%).  Two  monitors  each  also  felt  that  "31  to  45  hours," 
or  "46  to  60  hours,"  or  "over  60  hours"  might  be  recaptured 
(2  or  6.5%  each).  Four  respondents  (12.9)  declined  to  make 
an  estimate. 

Questions  35  and  39.  These  questions  were  the  most 
subjective  posed  during  the  interviews.  Twenty— three 
personnel  said  "yes,"  they  would  change  the  ICR  program  if 
they  could.  Seven  (22.6%)  said  "no,"  they  would  not,  and  1 
(3.2%)  "didn’t  know." 

Of  those  personnel  desiring  change,  most  referred  to 
Question  19  and  recommended  elimination  of  the  program  or 
inclusion  into  a  mandatory  self -inspection  program.  One 
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answer  indicated  that  the  program  was  “not  suited  to  a 
military  organization  but  was  better  suited  for  the  remain¬ 
der  of  DoD. ”  More  locally  instituted  ICRs  for  commander 
use  was  suggested,  as  well  as  moving  the  program  under  the 
IG.  The  suggestor  felt  that  under  the  IG  there  would  be  an 
objective  fresh  look.  Too  many  FAMs  cannot  “see  the  forest 
for  the  trees"  one  of  the  reasons  the  “independence"  GAO 
standard  was  originally  conceived. 

One  monitor  suggested  making  ICRs  an  MEI  or  command 
special  interest  item  (SII).  Another  suggested  including 
it  under  the  Fraud,  Waste,  and  Abuse  (FW&A)  regulation 
"umbrella"  with  quarterly  meetings  held  in  conjunction  with 
a  base  FW&A  council. 

One  monitor  suggested  a  "cross-over  program"  where 
FAMs  from  one  area  would  visit  another  area  and  assist  with 
an  ICR.  They  would  have  nothing  to  lose  and  reciprocity 
could  help  the  FAM  find  a  weak  area  not  seen  by  others 
working  in  the  review  area. 

Some  respondents  stated  that  the  amount  of  paperwork 
would  be  cut  if  the  program  were  streamlined.  Incorpora¬ 
tion  with  self-inspection  would  also  reduce  reporting 
requirements .  Several  monitors  stated  that  Accounting  and 
Finance  has  been  doing  an  ICR  type  Quality  Assurance  (QA) 
program  for  years,  current  ICRs  are  similar  to  QAs,  the 
FAMs  and  remaining  Comptroller  community  could  learn  from 
ACF.  Even  a  minor  format  change  could  render  the  program 


simpler,  easier  to  understand,  and  more  like  the  QA  program 
it  appears  to  be  mimicking.  A  testing  and  evaluation 
approach  would  make  the  program  more  beneficial  to  all 
managers . 

Another  suggestion  advocated  more  "unique"  subject 
areas,  e.g.,  those  not  already  covered  under  a  self-inspec* 
tion  or  other  internal  audit  program.  Other  suggestions 
included  better  coordination  of  efforts  through  the  chain 
of  command,  getting  the  list  of  required  ICRs  into  the 
field  sooner,  and  getting  the  Cost  Branch  back  into  the 
reporting  loop  between  the  FAM  and  the  base/wing 
commanders . 

Serious  impediments  to  proper  completion  of  ICRs  in¬ 
cluded  lack  of  training  for,  and  program  awareness  of,  the 
Functional  Area  Managers,  and  their  poor  attitude  toward  an 
"unnecessary  program. "  FAMs  tend  to  follow  "the  letter  of 
the  law"  without  meeting  the  true  intent  of  the  program — 
better  internal  management  control  over  resources. 

Monitors  stated  that,  since  the  program  is  difficult 
to  explain  and  difficult  for  some  to  understand,  it  is  not 
well  accepted.  Managers  believe  that  fear  of  reprisal 
often  keeps  everyone  from  accurately  performing  ICRs  and 
reporting  weaknesses. 

A  large  concern  of  several  ICR  monitors  was  the 
quality  of  personnel  appointed  by  managers  to  complete 
ICRs.  Often  the  appointee  is  a  new  arrival  or  a  person 


junior  in  rank  and  experience  because  the  senior  managers 
are  "too  busy."  These  personnel  may  not  be  familiar  with 
the  functional  area,  be  inexperienced  in  general,  and 
lacking  in  understanding  of  resource  management  and  the 
objectives  of  internal  management  control  systems. 
Competent,  qualified,  and  well-trained  personnel  are  needed 
to  perform  ICRs.  Inexperienced  personnel  can  harm  rather 
than  help  the  process. 

Manning  can  cause  FAMs  to  treat  the  program  as  "nice 
to  have,  but..."  the  effort  is  not  pe'rceived  as  worthwhile. 
The  efforts  expended  thus  far  have  exceeded  the  benefits 
received. 

Other  limitations  seen  by  the  monitors  were  the  lack 
of  standardization  in  the  program  throughout  Air  Force 
major  air  commands  and  the  delays  in  getting  the  new 
regulation  into  the  field.  A  new  one  is  needed  as  soon  as 
possible.  The  large  amount  of  documentation  required  for 
future  audits,  end  of  year  certification,  and  inspections 
is  stated  as  detracting  from  the  purpose  of  the  ICR. 
Guidance  on  the  amount  and  type  of  documentation  should  be 
standardized  and  included  in  the  new  regulation.  Current 
guidance  frequently  comes  from  the  major  air  commands  and 
is  difficult  to  follow.  Monitors  feel  as  if  they  are 
"always  defending"  the  program  (see  responses  to  Questions 
1,  5,  11,  14,  and  *21).  The  new  regulation  should  include 
examples  of  what  documentation  makes  a  viable  audit  trail, 


and  tips  on  how  to  train  FAMs  since  cost  analysts  are  not 
trained  instructors. 

Lack  of  coordinated  effort  and  lateness  of  the  annual 
ICR  list  into  the  field  were  also  cited  as  detrimental  to 
the  program.  If  ICRs  became  a  "theme  program"  a  "tip  of 
the  month"  could  keep  awareness  peaked  without  imposing 
more  controls  while  making  the  objectives  clearer. 

Question  1 .  The  majority  of  personnel  surveyed  feel 
that  the  ICR  program  is  redundant.  They  also  stated  (67.7% 
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or  21  responses)  that  the  ICR  requirement  was  unnecessary. 
Three  responses  (9.7%)  identified  the  program  as  "a 
necessary  evil."  Several  stated  that  as  the  program 
becomes  a  way  of  life,  it  gains  more  acceptance,  but  the 
FAMs  feel  they  are  audited  by  everyone.  In  the  opinion  of 
several  ICR  monitors,  a  program  that  was  once  misunderstood 
is  now  being  tolerated  by  the  FAMs. 

Two  monitors  (6.5%)  commented  that  their  FAMs  thought 
the  program  is  a  good  one,  they  are  glad  to  find  more  ways 
to  identify  errors.  Three  (9.7%)  felt  that  it  is  a  fair 
program,  while  one  (3.2%)  had  mixed  responses  and  one  had 
received  no  feedback  (3.2%). 

Questions  2  through  4.  The  average  Cost  Analysis 
Branch  spent  one  work  week  a  year  (42  hours)  monitoring, 
correcting,  training  and  completing  the  administrative 
duties  required  to  perform  an  average  of  5  ICRs  per  year. 
Recently,  FY  85  and  FY  86,  this  number  has  dropped  from  10 
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per  year  and  22.6%  (7  respondents)  of  the  offices,  there 
have  been  no  ICRs  required  during  these  two  years. 


Twenty-three  bases,  or  74.2%,  had  no  late  ICRs,  others 
had  one  or  two,  with  one  base  reporting  11  late  over  the 
four  year  course  of  the  program.  Most  monitors  stated  that 
it  took  a  great  deal  of  effort  to  prevent  late  reviews. 

They  often  called  the  Functional  Area  Managers  a  few  days 
or  a  week  before  a  review  was  due  to  the  commander  to 
remind  them  of  their  responsibilities. 

t 

Questions  5,  12, and  26.  The  ICR  monitors  felt  that 
most  Functional  Area  Managers  had  come  to  understand  that 
performance  of  a  review  was  their  responsibility  (19  or 
61.3%),  but  10  FAMs  (32.3%)  felt  that  it  was  either  a 
Comptroller  Division  exercise  or  belonged  to  another  agency 
such  as  the  Audit  Agency.  Two  monitors  were  not  sure  how 
their  FAMs  felt  about  the  subject. 

Exactly  the  same  number  (19)  of  Cost  Branches  felt 
that  ICR  monitoring  belongs  in  their  office  with  10  again 
feeling  that  the  Auditors  or  Inspector  General  should  have 
the  responsibility.  Two  were  not  sure  what  the  proper 
location  for  the  program  is  if  it  is  not  in  Cost  Analysis. 
Many  respondents  had  mixed  feelings,  since  cost  analysts 
are  not  properly  trained  as  auditors  (see  Training  above) 
to  monitor  the  program. 

Supporting  the  idea  that  Cost  Analysis  is  the  proper 
location  for  the  program,  6  monitors  (19.4%)  felt  strongly 
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that  ICRs  should  be  performed  by  a  separate  agency,  one  was 
open  to  the  idea  of  a  separate  agency,  but  the  remaining  24 
responses  (77.4%)  felt  that  a  separate  agency  would  not 
really  be  the  answer. 

Questions  6.  7.  and  8.  Most  Functional  Area  Managers 
do  not  have  a  formal  plan  (20  or  64.5%)  beyond  the  Air 
Force  and  command  program  instructions  as  far  as  the 
monitors  know,  while  eight  (25.8%)  knew  of  at  least  one 

such  plan  at  their  location.  Three  did  not  know  if  their 

* 

FAMs  had  a  formal  organizational  plan. 

Exactly  the  same  number  (20  or  64.5%)  Cost  Branches 
do  not  have  office  instructions,  but  8  (25.8%)  have 
incorporated  ICR  procedures  into  office  memos,  self- 
inspection  programs,  or  in  one  case,  a  complete  ICR 
handbook/continuity  folder. 

Almost  everyone  was  aware  that  a  formal  follow-up  plan 
would  be  required  if  material  weaknesses  were  found  but 
only  24  had  a  formal  plan.  Seven  said  that  if  a  weakness 
were  found,  a  plan  would  be  written. 

Question  9.  Most  monitors  felt  that,  as  long  as  the 
program  remained  the  way  it  is  now  (heavier  workload  on  the 
FAM3  rather  than  ACC),  there  were  sufficient  personnel 
assigned  to  their  office  (25  or  77.4%).  Five  (16.1%)  felt 
that  they  were  undermanned,  and  1  (3.2%)  was  not  sure  since 


it  was  a  recent  assignment. 


The  majority  of  monitors 


(24  or  77.4%)  stated  that  reviews  provided  an  adequate 
audit  trail  for  future  inspections.  This  was  attributed  by 
15  monitors  (48.4%)  to  the  fact  they  frequently  discuss 
*  reviews  before  they  are  forwarded  to  command,  and  3  more 
(9.7%)  do  so  occasionally.  One  response  registered  a  rare* 
occurrence  of  a  meeting  prior  to  forwarding,  while  9 
(29.0%)  said  they  never  saw  the  reviews  until  forwarding 
since  the  program  took  ACC  out  of  the  direct  loop  to  the 
commander.  The  three  remaining  respondents  were  command 
level,  therefore  the  question  was  not  applicable. 

Twelve  (38.7%)  spot-check  review  audit  trail  paperwork 
frequently  to  ensure  FAMs  are  in  compliance  with  ICR  docu¬ 
mentation  requirements.  Five  (16.1%)  monitors  do  this  type 
of  a  review  sometimes,  4  (12.9%)  do  so  rarely,  and  10 
(32.3%)  never  review  the  documents. 

Question  11.  Monitors  were  divided  on  this  question. 
14  (45.2%)  felt  that  FAMs  were  generally  free  to  do  their 
work  independent  of  pressure  from  senior  management,  but  7 
(22.6%)  said  that  at  least  one  person  at  their  base  was  not 
given  independence  to  report  findings  and  recommendations. 
Ten  (32.3%)  were  sure  that  most  of  the  time  they  were  not 
told  whether  a  FAM  was  independent. 

Question  13.  Most  responses  were  in  favor  of  a 
> 

crossfeed  program  (27  or  87.1%),  but  several  qualified  it 
with  comments  about  timeliness  or  relevancy.  Three  (9.7%) 
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were  not  sure  that  crossfeed  would  be  of  value.  Reasons 
given  included  getting  the  data  to  a  base  soon  enough  to  be 
of  value  and  reluctance  to  see  another  possible  Management 
Effectiveness  Inspection  (MEI)  item. 

Anonymity  received  mixed  comments.  It  was  considered 
good  for  protection  of  errors,  but  poor  if  a  base  needed  to 
follow-up  a  report  and  obtain  more  detailed  information  to 
apply  a  corrective  system  or  improve  procedures. 

Question  14.  Although  10  (32.3%)  said  that  they  felt 
the  ICRs  at  their  bases  were  not  being  "pencil  whipped,"  a 
larger  portion  (20  or  64.5%)  felt  that  there  was  some 
degree  of  personnel  either  not  reporting  what  they  found  or 
writing  a  report  without  physically  performing  an  internal 
review.  One  person  declined  to  comment.  Several  persons 
stated  that,  although  they  could  say  there  was  no  "pencil 
whipping"  happening  now,  in  the  past  they  had  caught  one  or 
two  ICRs  that  were  "suspicious"  and  had  them  rewritten. 

Most  comments  centered  on  the  idea  that  many  FAMs 
consider  the  program  either  "unnecessary"  or  a  "necessary 
evil"  and  do  the  minimum  amount  of  research  they  can  to 
"get  by."  Many  FAMs  are  deeply  concerned  about  "airing 
their  dirty  laundry"  to  the  world  and  therefore  "shooting 
themselves  in  the  foot."  They  therefore  often  delay  the 
writing  of  a  review  until  they  can  get  a  problem  fixed  (see 
Question  4)  or  keep  the  findings  shallow,  according  to  the 


ICR  monitors. 


This  question  seemed  to  cause  some 


confusion,  when  the  words  "subjects  of  substance"  were 
substituted  for  "appropriate  subjects,"  the  confusion 
cleared.  Eighteen  (58.1%)  felt  that  subjects  were  not  just 
"bean  counting"  or  administrative  exercise  type  subjects, 
but  9  (29.0%)  did  not,  and  4  (12.9%)  were  not  sure.  Most 
comments  seemed  to  reflect  that  ICRs  are  now  repetitive  and 
risk  becoming  less  meaningful  as  topics  are  depleted. 

Question  16.  17.  and  18.  Most  (26  or  83.9%)  felt  that 
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ICR  findings  were  being  properly  reported  to  the  commander 
because  they  worked  toward  that  goal.  Two  (6.5%)  felt  that 
the  "possible  pencil  whipping"  prevented  all  the  "true 
results"  from  being  reported,  while  3  (9.7%)  just  were  not 
sure . 

Most  Cost  Analysis  Branches  felt  that  the  local 
commanders  supported  the  ICR  program  (24  or  77.4%)  partly 
because  they  had  to  certify  an  annual  statement.  In  TAC, 
only  the  MAJCOM  commander  signs  the  annual  statement  and 
the  TAC  respondents  still  feel  they  enjoy  command  support. 
Three  (9.7%)  felt  that  their  commanders  did  not  support  the 
program  fully  because  it  was  duplicative  and  4  (12.9%) 
didn't  know  since  there  had  been  few  or  no  ICRs  performed 
since  they  had  become  the  monitor. 

Thirteen  monitors  (41.9%)  felt  that  their  commanders 


would  get  involved  if  weakness  were  found  during  a  review, 
10  (32.3%)  said  they  would  not,  but  might  pass  it  to  vice 


commanders  or  squadron  commanders.  Eight  (25.8%)  did  not 
care  to  venture  an  opinion,  since  no  weaknesses  had  been 
found  during  their  tenure  as  the  ICR  monitor. 

Question  20.  Most  monitors  had  been  performing  duties 
either  a  short  period,  0  to  12  months  (13  or  44.8%),  or  a 
longer  period,  25  months  to  since  the  program  began  (12  or 
41.4%).  The  remaining  13.8%  (4)  have  served  as  ICR 
monitors  between  13  and  24  months. 

Questions  21.  22.  23  and  25.  The  larger  number  of 


responses  (13  or  41.9%)  stated  that  FAMs  saw  Internal 
Control  Reviews  as  only  a  little  help  in  controlling  waste, 
fraud,  and  abuse.  Seven  responses  (22.6%)  felt  that  their 
FAMS  saw  them  as  somewhat  of  a  help,  6  (19.4%)  felt  they 
were  not  seen  as  a  help  at  all,  while  5  (16.1%)  did  not 
know  how  their  FAMs  felt  about  the  issue. 

The  monitors  themselves  believed  that  (4  or  12.9%),  if 
the  reviews  were  properly  performed,  they  would  provide 
insight  to  the  commander  for  resource  control  and  manage¬ 
ment.  Five  (16.1%)  felt  that  the  insight  was  limited  to 
slight  (18  or  58.1%)  because  of  the  way  the  ICRs  were 
performed  or  used  rather  than  the  way  they  are  intended  to 
be  used.  Four  (12.9%)  felt  that  the  commander  gained  no 
insight . 

Monitors  believe  that  internal  controls  are  necessary 
management  tools.  Twenty  (64.5%)  felt  they  were  a  very 
necessary  tool,  6  (19.4%)  felt  that  they  were  somewhat 
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necessary,  4  (12.9%)  felt  they  were  a  little  useful,  and 
only  1  (3.2%)  saw  them  as  useless.  Comments  centered  on 
overuse  versus  quality  tools.  The  abundance  of  controls  in 
multiple  enforcement  forms  is  a  burden  to  managers 
according  to  monitors  in  the  latter  two  categories. 

A  few  managers  agreed  that  including  what  was  expected 
and  how  a  manager  handled  internal  control  responsibilities 
in  performance  reports  might  be  very  valuable  in  gaining 
support  for  the  ICR  program  (6  or  19.4%).  Nine  more  re¬ 
spondents  (29.0%)  felt  that  it  might  be  somewhat  of  a  help, 
but  11  (35.5%)  felt  that  it  would  only  help  a  little,  and 
5  (16.1%)  felt  that  it  would  be  of  no  value.  Many  monitors 
3tated  that,  if  performance  reports  were  truer  measures  of 
performance,  the  inclusion  of  how  well  one  employed 
internal  controls  would  be  unquestionably  valid.  The 
current  feeling  is  that  their  inclusion  would  be  ju3t 
another  inflation  factor.  Others  felt  that  including 
internal  controls  in  performance  reports  could  improve  the 
program  visibility  greatly. 

Several  monitors  stated  that  internal  controls  would 
be  especially  appropriate  in  performance  reports  of 
personnel  responsible  for  major  resource  management.  Cost 
analysts,  for  instance,  are  often  involved  in  the  "Report 
of  Survey"  program,  as  are  commanders.  How  well  they  meet 
the  challenge  of  this  task  should  be  documented.  One 
monitor  stressed  that  senior  management  is  supposed  to 
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support  the  program  whether  or  not  the  responsibilities  are 
documented  in  any  type  of  performance  reports. 

Questions  27  through  30.  Only  5  monitors  (16.1%)  are 
frequently  called  to  assist  FAMs  completing  ICRs.  Nine 
(29.0%)  are  called  in  sometimes,  7  (22.6%)  rarely,  and 
about  one-third  (10  or  32.3%)  have  not  been  called  in  at 
all.  Similarly,  6  (9.7%)  have  been  asked  to  assist  in 
gaining  commanders’  support  sometimes,  2  (6.5%)  were  rarely 
asked,  while  23  (74.2%)  have  never  been  asked. 

f 

With  regard  to  training,  11  monitors  (35.5%)  state 
they  are  rarely  asked  to  provide  procedure  training  and  7 
(22.6%)  are  called  sometimes.  Monitors  state  this  occurs 
primarily  because  the  monitors  contact  the  Functional  Area 
Managers  and  provide  training  as  soon  as  a  new  ICR  require¬ 
ment  becomes  known.  Only  3  (9.7%)  said  they  receive 
frequent  requests,  while  about  a  third  (10  or  32.3%)  have 
never  been  called  to  provide  training. 

Monitors  are  more  frequently  used  as  consultants 
during  ICR  proceedings.  According  to  the  monitors,  this 
role  entails  further  explanations  of  objectives,  defini¬ 
tions,  review  of  documentation,  and  formatting.  Eleven 
(35.5%)  stated  that  they  were  sometimes  requested  to  serve 
as  consultants  and  4  (12.9%)  were  frequently  called.  Nine 
monitors  (29.0%)  were  rarely  asked  to  serve  in  this 


capacity  while  7  (22.6%)  had  never  been  contacted  for  this 
service.  Those  not  being  contacted  felt  that  it  is  the 


FAMs  place  to  contact  them  when  problems  arise.  They,  the 
monitors,  have  been  advertising  their  availability,  but  the 
requests  for  their  services  is  lower  than  they  would  like. 

Question  37.  Captains  made  up  the  largest  number  of 
monitors  interviewed  (9  or  29.0%)  with  Lieutenants  second 
(6  or  19.4%).  Five  personnel  (16.1%)  interviewed  were  GS- * 
12  or  higher  with  3  (9.7%)  GS-9  personnel  involved.  Two 
each  of  the  Staff  Sergeant/Technical  Sergeant  rank  and  the 
GS-11  categories  were  interviewed  amounting  to  6.5% 
respectively.  A  Master  Sergeant,  one-  Colonel,  one  GS-6, 
and  one  GS-7  (3.2%  each)  completed  the  31  interview 
participants . 

Question  38.  Eight  bases  each  of  the  "4,001  to  6,000" 
population  (25.8%)  and  of  "over  12,000"  (25.8%)  were  repre¬ 
sented.  Five  bases  represented  the  "2,001  to  4,000"  cate¬ 
gory  (16.1%)  and  four  bases  met  the  "6,001  to  8,000" 

(12.9%)  category.  Two  bases  each  fell  into  the  "0-2,000" 
population  category,  the  "8,001  to  10,000"  group,  and  the 
"10,001  to  12,000"  categories  accounting  for  6.5%  of  the 
respondents  each. 

Aoaly.g.i.g 

Each  question  was  statistically  compared  to  base 

population,  rank  structure,  Major  Air  Command  of  the  ICR 

monitor,  the  length  of  time  an  ICR  monitor  had  served,  and 

» 

level  of  training  each  felt  they  had  received,  the  major 


results  follow. 


Of  the  Functional  Area  Managers 


who  felt  ICRs  are  their  responsibility,  the  majority  felt 
the  program  was  unnecessary.  It  was  not  a  function  of 
their  major  air  command  MAJCOM  or  the  length  of  appointment 
time  of  their  ICR  monitors. 

If  there  was  no  additional  formal  plan,  either  in  the 
FAM  or  the  Cost  Branch,  the  personnel  felt  the  program  was 
unnecessary.  This  was  also  not  related  to  the  amount  of 
time  served  as  a  monitor  or  the  command,  except  within 

s 

SAC.  Strategic  Air  Command  (SAC)  personnel  felt  that  the 
program  was  good. 

SAC  personnel  stated  they  were  better  trained  than  the 
other  commands  who  had  no  formal  plans. 

The  fact  that  a  monitor  or  a  FAM  felt  the  program  was 
unnecessary  was  not  a  function  of  time  as  the  ICR  monitor 
or  the  command  to  which  they  were  assigned. 

Those  personnel  performing  ICRs  who  felt  that  the 
program  was  unnecessary  tended  to  feel  crossfeed  would 
benefit  the  program.  The  desire  for  crossfeed  was  not  a 
function  of  time  served  as  an  ICR  monitor  of  the  MAJCOM  of 
assignment . 

The  majority  of  monitors  felt  that  there  was  some 

"pencil  whipping"  at  some  point  during  the  program, 

although  SAC  personnel  recorded  none.  This  also  was  not  a 

» 

function  of  the  time  served  as  monitor  or  the  command, 
except  within  SAC. 
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Those  whose  FAMs  felt  the  program  was  unnecessary 
tended  to  feel  the  ICR  subjects  were  appropriate  rather 
than  clerical.  This  was  not  a  function  of  the  time  served 
as  an  ICR  monitor  or  the  command  to  which  assigned. 

SAC  personnel  whose  FAMs  rated  the  program  as 
unnecessary  think  that  weaknesses  were  properly  reported  to 
a  supportive  commander.  Otherwise,  those  who  felt  that  the 
program  was  unnecessary  and  the  relationship  with  their 

commanders  was  not  a  function  of  command  or  time  served  as 

* 

monitor. 

Commanders  were  not  as  involved  when  responses 
indicated  that  the  program  was  unnecessary,  this  was  not  a 
function  of  length  of  time  in  monitor  duties  or  the 
command . 

Those  monitors  whose  FAMs  felt  the  program  unnecessary 
also  advocated  merger  with  another  program.  This  was  found 
especially  within  AFLC  and  SAC. 

The  ICR  Program  was  not  believed  by  FAMs  to  be  an  aid 
at  all  or  only  rarely  controlling  fraud,  waste,  and  abuse 
when  they  felt  that  the  program  was  unnecessary.  This  was 
not  a  function  of  command. 

Feelings  that  the  ICR  program  provided  insight  to  the 
commander  were  also  not  tied  to  command  or  length  a  monitor 
had  served. 
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Internal  controls  were  considered  very  important  even 
when  the  ICR  Program  was  felt  unnecessary,  regardless  of 
length  of  monitor  duties  or  command. 

Those  monitors  who  felt  that  the  program  was  unneces¬ 
sary  predominantly  (74.2%)  were  those  who  felt  that  ICRs 
are  "just  another  self -inspection"  without  regard  for 
length  of  monitorship  or  command. 

Monitors  and  FAMS  who  felt  that  ICRs  should  not  be  a 
separate  office  under  the  Comptroller  especially  felt  that 
the  program  was  unnecessary  overall  without  respect  for 
length  of  time  in  monitor  duties  or  MAJCOM. 

Monitors  who  were  rarely  asked  for  assistance  were 
also  those  who  felt  the  program  was  unnecessary.  ICR 
Monitors  who  were  asked  to  act  as  consultants  were  split 
between  those  feeling  the  program  was  unnecessary  and  those 
that  did  not,  but  the  results  were  not  a  function  of  length 
of  time  served  as  ICR  monitor  or  MAJCOM. 

Those  monitors  and  FAMS  who  felt  the  program  was 
unnecessary  did  not  fall  into  any  particular  rank 
structure,  nor  did  the  majority  of  the  questions  show  a 
significant  response  imbalance  within  rank.  Captains, 
however,  did  have  a  strong  desire  to  see  a  mandatory 
crossfeed  program  and  ICR  program  changes  implemented. 

Internal  Controls  and  the  Internal  Control  Review 
Program  are  seen  as*  additional  duties,  an  added  respon¬ 
sibility  with  no  added  benefits.  Headquarters  Air  Force 


Logistics  Command  employs  two  GS-12s  almost  full-time  as 
the  command  ICR  monitors.  Base  Cost  Analysis  Branches  have 
not  seen  any  increased  manpower  authorizations  to  cover  the 
added  workload,  nor  have  functional  areas.  The  concept  of 
,an  "additional"  duty  de-emphasizes  the  importance  of 
internal  management  control.  Comments  from  monitors 
indicated  that  Internal  Control  Reviews  are  an  "albatross" 
and  "cumbersome"  to  manage,  making  a  manager's  job  more 
difficult,  not  simpler. 

I 

Summary 

The  statistical  data  supports  the  investigative 
questions.  Monitors  feel  that  the  current  ICR  program  is 
managed  in  accordance  with  existing  directives,  but  a  new 
less  complex  directive  is  needed.  A  new  directive  should 
simplify  and  consolidate  guidance,  standardizing  procedures 
across  commands. 

Survey  results  suggest  that  "there  is  a  more  efficient 
way"  to  run  the  Internal  Control  Review  Program.  The 
majority  of  the  interviewees  feel  that  it  should  be  stream¬ 
lined  and  incorporated  using  a  new  mandatory  self-inspec¬ 
tion  program  to  ensure  effectiveness. 

Duplication  of  reports  and  general  duplication  of 
fraud,  waste,  and  abuse  efforts  need  to  be  decreased.  This 
suggested  change  is  expected  to  decrease  manhours  expended, 

I 

increase  productivity  within  the  ACC  Branches  (as  well  as 
the  functional  areas)' and  improve  the  attitude  toward,  and 


management  support  of,  the  ICR  program.  The  costs  will 
decrease  and  benefits  increase.  Managers’  attitude  toward 
the  program  will  change  as  the  program  benefits  rise. 


Incorporation  of  the  ICR  program  into  self-inspection 
will  "put  teeth"  into  the  self -inspection  program  and  allow 
the  ICR  program  to  be  perceived  as  a  management  tool,  not 
just  another  additional,  and  resented,  duty. 
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This  study  was  unusual  in  that  it  is  designed  to 
■evaluate  an  evaluation  program.  Reports  from  practitioners 
led  to  many  questions  about  the  Internal  Control  Review 
Program  ranging  from  questioning  its  cost  effectiveness  to 
doubting  its  overall  usefulness.  Findings  (Chapter  IV) 
indicate  at  least  some  problems  as  well  as  some  solutions 
which  have  been  suggested  by  practitiohers .  The  results 
of  this  study  suggest  the  primary  problem  areas  to  be: 

1 .  Lack  of  education  and  training  of  both  monitors 
and  managers . 

2.  A  strong  feeling  that  the  Internal  Control  Program 
is  unnecessary;  a  duplication  of  effort,  with 
other  programs. 

3.  A  questioning  of  the  costs  versus  benefits 
received  through  implementation  of  the  program. 

At  the  operational  level  there  seems  to  be  a  miscon¬ 
ception  and  sometimes  a  complete  lack  of  understanding  of 
the  purpose  and  objectives  of  the  Internal  Control  Program. 
There  is  evidence  that  many  reviews  lack  in-depth  analysis 
as  a  result  of  the  above  and  other  factors  (see  Questions 
14  and  15).  Managers  and  commanders  at  some  levels 
hesitate  to  commit  manpower  and  money  resources  to  a 
program  they  feel  belongs  primarily  to  the  Comptroller 
Division,  again  suggesting  a  lack  of  understanding. 


Training  and  Education.  It  certainly  is  not  clear  to 
many  involved  in  the  performance  of  the  ICR  program  whether 
the  purpose  of  ICRs  is  to  discover  or  immediately  correct 
problems  identified  through  an  ICR,  or  to  prevent  these 
problems  on  a  larger  scale,  such  as  wing  or  command. 
Training  was  needed  in  a  number  of  areas  in  the  view  of 
many  of  those  interviewed  (see  answer  to  Question  34  in 
Chapter  IV).  Many  respondents  felt  that  they  needed  a 
review  of  the  program’s  objectives.  Training  was  also  seen 
as  of  the  utmost  importance  by  both  thfe  GAO  and  the  Army’s 
Forsythe  (34:6-8;  44:3). 

Confusion  over  guidance  has  caused  problems  at  a 
number  of  bases  whose  ICR  monitors  were  interviewed. 

Several  bases  in  separate  commands  have  a  handbook  or 
checklists  for  monitoring  and  completing  ICRs.  Recommend 
these  be  gathered,  reviewed,  and  made  into  an  Air  Force¬ 
wide  handbook  which  would  use  the  new  guidance  as  its 
basis.  The  current  300  plus  page  instruction  volumes  are 
too  cumbersome  for  most  personnel  to  digest  and  implement, 
unaided. 

There  is  evidence  at  the  operational  level  that  all 
material  weaknesses  are  not  being  reported  properly  (45). 
Personnel  performing  ICRs  tend  to  dismiss  the  purpose  of 
management  findings  versus  later  inspection  findings. 
Frequently  this  is  ’a  result  of  time  constraints. 
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This  also  implies  that  there  may  be  a  fundamental 
disagreement  as  to  proper  implementation  of  the  act  between 


> 


> 


OMB  and  the  agencies  affected  by  0MB  Circular  A-123.  It 
may  also  be,  assuming  internal  management  control  is 
considered  the  prerogative  of  each  agency,  that  affected 
agencies,  in  general,  believe  the  correction  of  their 
managerial  discrepancies  should  remain  totally  within  the 
perview  of  the  expert  in  the  functional  area  of  operations. 
Trained  personnel  also  take  less  time  performing  tasks  than 

t 

untrained. 

When  personnel  know  they  will  be  evaluated  on  the 
duties  and  responsibilities  involved  in  internal  management 
controls,  they  will  tend  to  place  emphasis  in  that  area. 
Personnel  need  to  be  made  aware  of  the  exact  purpose  of  the 
ICR  program.  Based  on  the  findings  in  Chapter  IV,  there  is 
evidence  that  operational  ICR  monitors  and  Functional  Area 
Managers  do  not  fully  understand  reporting  requirements. 

An  Unnecessary  Program?  Command  emphasis  is  needed  to 
assure  commanders  and  Functional  Area  Managers  that  the  ICR 
program  is  not  only  of  value,  but  does  not  place  a  burden 
on  already  heavily  taxed  resources. 

The  lack  of  emphasis  and  interest  in  the  ICR  program 
can  be  seen  in  the  results  of  Question  14  in  Chapter  IV. 


Monitors  see  the  results  in  a  frequent  lack  of  in-depth 
research  into  a  functional  area  and  cutting  corners  on  time 
expended  in  performing  ICRs.  They  stated  that  to  prevent 
inadequate  or  late  reports  they  had  to  call  Functional  Area 
Managers  to  rewrite  or  even  redo  an  ICR  from  scratch. 

Cost/Benefit  Ratio.  That  some  learning  has  occurred 
over  the  past  fiscal  years  is  evident  in  the  statistics 
(reference  Questions  2,  3,  and  4).  Many  managers  are  still 

concerned  about  the  input  of  resources  into  a  questionable 

/ 

program. 


Recommendations 

Training,  education,  and  the  guidance  need  simplifi¬ 
cation.  Perhaps  a  study  performed  by  the  Human  Resources 
Laboratory  or  Air  Force  Institute  of  Technology  personnel 
could  discover  the  exact  training  requirements.  They  could 
devise  a  package  clarifying  the  need  for  and  requirements 
of  the  program  for  managers  at  all  levels. 

Recommend  research  into  the  legality  of  combining  the 
ICR  and  self -inspection  programs.  If  it  is  legal,  should 
the  two  be  integrated  to  conserve  resources? 

Recommend  a  cost/benefit  analysis  be  completed,  to 
include  the  functional  areas  as  well  as  the  ICR  monitors, 
to  validate  the  program  objectives. 

If  one  clear  piece  of  information  has  emerged  from 
this  study,  it  is  that  the  lack  of  an  up-to-date  and 
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ON  THE  SEA  THERE  IS  A  TRADITION  OLDER 
EVEN  THAN  THE  TRADITIONS  OF  THE  COUNTRY 
ITSELF,  IT  IS  THE  TRADITION  THAT  WITH 

r 

RESPONSIBILITY  GOES  AUTHORITY  AND  WITH 
THEM  BOTH  GOES  ACCOUNTABILITY. 


Reprinted  from  Kincaid,  March  1981  (57:20). 


Appendix  A: 


Internal  Controls.  The  plan  of  organization  and  all  of  the 
methods  and  measures  adopted  within  the  Department  of 
Defense  to  safeguard  its  resources,  assure  the  accuracy  and 
reliability  of  information,  assure  adherence  to  applicable 
.laws,  regulations  and  policies,  and  promote  operational 
economy  and  efficiency. 

Internal  Control  Documentation.  Written  policies, 
organization  charts,  procedural  write  ups,  manuals, 
memoranda,  flow  charts,  decision  tables,  completed 
questionnaires,  software,  and  related  written  materials 
used  to  describe  the  internal  control  methods  and  measures, 
to  communicate  responsibilities  and  authorities  for 
operating  such  methods  and  measures ,  and  to  serve  as  a 
reference  for  persons  reviewing  the  internal  controls  and 
their  functioning. 

Internal  Control  Review.  A  detailed  examination  of  an 
agency’s  or  agency  component’s  system  of  internal  control 
to  determine  whether  adequate  control  measures  exist  and 
are  implemented  to  prevent  or  detect  the  occurrence  of 
potential  risks  in  a  cost  effective  manner. 

Internal  Control  System.  The  totality  of  the  methods  and 
measures  of  internal  control  established  by  DOD  components 
individually  or  collectively. 

Vulnerability  Assessment.  A  review  of  the  susceptibility 
of  the  Department  of  Defense  or  a  DOD  program  to  loss  or 
unauthorized  use  of  resources,  errors  in  reports  and 
information,  illegal  or  unethical  acts,  and  adverse  or 
unfavorable  public  opinion.  Vulnerability  assessments  do 
not  identify  weaknesses  or  result  in  improvements.  They 
are  the  mechanism  with  which  a  component  can  determine 
quickly  the  potential  for  losses  in  its  different  programs 
or  functions.  The  schedule  of  internal  control  reviews 
should  be  based  on  the  results  of  the  vulnerability 
assessments . 


All  definitions  are  extracted  from  AFR  170-22,  Attachment 
2,  page  11. 


The  objectives  of  internal  control  are  to  provide 
DOD  management  with  reasonable  assurance  that: 


a.  Financial  and  other  resources  are  safeguarded 
from  unauthorized  use  or  disposition. 

b.  Financial  and  statistical  records  and  reports 
are  reliable  and  accurate. 

c.  Transactions  are  executed  in  accordance  with 
authorizations . 

d.  Applicable  laws,  regulations,  and  policies  are 
adhered  to. 

e.  Resources  are  efficiently  and  effectively 
managed . 

The  objectives  of  internal  control  can  be  achieved 

by: 

a.  Permitting  access  to  resources  only  in 
accordance  with  management’s  authorization. 

b.  Executing  transactions  in  accordance  with 
management’s  general  or  specific  authorization. 

c.  Recording  transactions  to  permit  preparation  of 
accurate  and  reliable  financial  and  statistical 
records . 

d.  Comparing  recorded  accountability  for  resources 
with  existing  resources  at  reasonable  intervals. 

tyidards 

Documentation .  Internal  controls,  accountability 
for  resources  and  all  financial  transactions  shall 
be  clearly  documented  and  documentation  shall  be 
available . 

Recording  of  Transactions.  Transactions  shall  be 
recorded  as  executed,  when  executed,  and  be 
properly  classified. 


Execution  of  Transactions.  Independent  evidence 
shall  be  maintained  that  authorizations  are  issued 
by  persons  acting  within  the  sco^e  of  their 
authority  and  that  transactions  conform  with  the 
terms  of  the  authorizations. 


Separation  of  Duties.  Key  duties  such  as 
authorizing,  approving,  recording  transactions, 
issuing  or  receiving  assets,  making  payments,  and 
reviewing  or  auditing  shall  be  assigned  to 
separate  individuals  to  minimize  the  risk  of  loss  - 
to  the  government.  Internal  Control  depends 
largely  on  the  elimination  of  opportunities  to 
conceal  errors  or  irregularities.  This,  in  turn, 
depends  on  the  assignment  of  work  in  such  a 
fashion  that  no  one  individual  controls  all  phases 
of  an  activity  or  transaction,  thereby  creating  a 
situation  that  permits  errors  or  irregularities  to 
go  undetected. 


Supervision.  Qualified  and  continuous  supervision 
shall  be  provided  to  assure  that  approved 
procedures  are  followed.  Lines  of  personal 
responsibility  and  accountability  shall  be  clear. 


Access  to  Resources.  Access  to  resources  shall  be 
limited  to  authorized  personnel.  Access  includes 
both  direct  physical  access  and  indirect  access 
through  the  preparation  of  processing  of  documents 
that  authorize  the  use  or  disposition  of  resources 
Periodic  comparison  shall  be  made  of  the  resources 
with  the  recorded  accountability  to  determine 
whether  the  two  agree.  The  frequency  of  the 
comparison  shall  be  a  function  of  the 
vulnerability  of  the  asset. 


Competent  Personnel.  Reasonable  care  shall  be 
taken  that  key  personnel  have  high  standards  of 
integrity  and  are  competent,  by  education, 
training,  or  experience,  to  accomplish 
their  assigned  duties. 


Reasonable  Assurance.  Internal  control  systems 
shall  provide  reasonable,  but  not  absolute, 
assurance  that  the  objectives  of  the  system 
will  be  accomplished.  This  standard  recognizes 
that  the  cost  of  internal  controls  should  not 
exceed  the  benefits  derived  therefrom,  and  that 
the  benefits  consist  of  reductions  in  the  risks 
of  failing  to  achieve  the  stated  objectives. 


1.  The  full  scope  of  an  audit  of  a  governmental 
program,  function,  activity,  or  organization 
should  encompass: 

a)  An  examination  of  financial  transactions, 
accounts,  and  reports,  including  an  evalua¬ 
tion  of  compliance  with  applicable  laws 
and  regulations . 

b)  A  review  of  efficiency  and  economy  in  the  U3e 
of  resources. 

c)  A  review  to  determine  whether  desired  results 
are  effectively  achieved. 

2.  The  auditors  assigned  to  perform  the  audit  must 
collectively  possess  adequate  professional 
proficiency  for  the  tasks  required. 

3.  In  all  matters  relating  to  the  audit  work,  the 
audit  organization  and  the  individual  auditors 
shall  maintain  an  independent  attitude. 

4.  Due  professional  care  is  to  be  used  in  conducting 
the  audit  and  in  preparing  related  reports . 


Examination  and  Evaluation  Standards 

1.  Work  is  to  be  adequately  planned. 

2.  Assistants  are  to  be  properly  supervised. 

3.  A  review  is  to  be  made  of  compliance  with  legal 
and  regulatory  requirements. 

4.  An  evaluation  is  to  be  made  of  the  system  of 
internal  control  to  assess  the  extent  it  can 
be  relied  upon  to  ensure  accurate  information, 
to  ensure  compliance  with  laws  and  regulations, 
and  to  provide  for  efficient  and  effective 
operations . 


Sufficient,  competent,  and  relevant  evidence  is 
to  be  obtained  to  afford  a  reasonable  basis  for 
the  auditor’s  opinions,  judgments,  conclusions 
and  recommendations. 


Written  audit  reports  are  to  be  submitted  to  the 
appropriate  officials  of  the  organizations 
requiring  or  arranging  for  the  audits.  Copies  of 
the  reports  should  be  sent  to  other  officials  who 
may  be  responsible  for  taking  action  on  audit 
findings  and  recommendations  and  to  others 
responsible  or  authorized  to  receive  such  reports. 
Unless  restricted  by  law  or  regulation,  copies 
should  be  made  available  for  public  inspection. 

Reports  are  to  be  issued  on  or'  before  the  dates 
specified  by  law,  regulation  or  other  arrangement 
and,  in  any  event,  as  promptly  as  possible  so  as 
to  make  the  information  available  for  timely  use 
by  management  and  by  legislative  officials. 

Each  report  shall : 

a)  Be  as  concise  as  possible,  but,  at  the  same 
time,  clear  and  complete  enough  to  be 
understood  by  the  users. 

b)  Present  factual  matter  accurately,  completely 
and  fairly. 

c)  Present  findings  and  conclusions  objectively 
and  in  language  as  clear  and  simple  as  the 
subject  matter  permits. 

d)  Include  only  factual  information,  findings,  and 
conclusions  that  are  adequately  supported  by 
enough  evidence  in  the  auditor's  working  papers 
to  demonstrate  or  prove,  when  called  upon,  the 
bases  for  the  matters  reported  and  their 
correctness  and  reasonableness.  Detailed 
supporting  information  should  be  included  in 
the  report  to  the  extent  necessary  to  make  a 
convincing  presentation. 

e)  Include,  when  possible,  the  auditor’s 
recommendations  for  actions  to  effect 
improvements  in  problem  areas  noted  in  his 
audit  and  to  otherwise  make  improvements  in 
operations.  Information  on  underlying  causes 


of  problems  reported  should  be  included  to 
assist  in  implementing  or  devising  corrective 
actions . 

f)  Place  primary  emphasis  on  improvement  rather 
than  on  criticism  of  the  past;  critical 
comments  should  be  presented  in  balanced 
perspective,  recognizing  any  unusual 
difficulties  or  circumstances  faced  by  the 
operating  officials  concerned. 

g)  Identify  and  explain  issues  and  questions 
needing  further  study  and  consideration  by 
the  auditor  or  others. 

h)  Include  recognition  of  noteworthy 
accomplishments,  particularly  when  management 
improvements  in  one  program  or  activity  may 
be  applicable  elsewhere. 

i)  Include  recognition  of  the  views  of  responsible 
officials  of  the  organization,  program, 
function,  or  activity  audited  on  the  auditor’s 
findings,  conclusions,  and  recommendations. 
Except  where  the  possibility  of  fraud  or  other 
compelling  reason  may  require  different 
treatment,  the  auditor’s  tentative  findings  and 
conclusions  should  be  reviewed  with  such 
officials.  When  possible,  without  undue  delay, 
their  views  should  be  obtained  in  writing  and 
objectively  considered  and  presented  in 
preparing  the  final  report. 

j)  Clearly  explain  the  scope  and  objective  of  the 
audit. 

k)  State  whether  any  significant  pertinent 
information  has  been  omitted  because  it  is 
deemed  privileged  or  confidential.  The  nature 
of  such  information  should  be  described,  and 
the  law  or  other  basis  under  which  it  is 
withheld  should  be  stated. 

Each  audit  report  containing  financial  reports 

shall : 

a)  Contain  an  expression  of  the  auditor’s  opinion 
as  to  whether  the  information  in  the  financial 
reports  is  presented  fairly  in  accordance  with 
generally  accepted  accounting  principles  (or 
with  any  other  accounting  principles  applicable 
to  the  organization,  program,  function  or 


activity  audited),  applied  on  a  basis 
consistent  with  that  of  the  preceding 
reporting  period.  If  the  auditor  cannot 
express  an  opinion,  the  reasons  therefore 
should  be  stated  in  the  audit  report. 

b)  Contain  appropriate  supplementary  explanatory 
information  about  the  contents  of  the  financial 
reports  as  may  be  necessary  for  full  and 
informative  disclosure  about  the  financial 
operations  of  the  organization,  program,  func¬ 
tion,  or  activity  audited.  Violations  of  legal 
or  other  regulatory  requirements,  including 
instances  of  non-compliance,  and  material 
changes  in  accounting  policies  and  procedures, 
along  with  their  effect  on  the  financial 
reports,  shall  be  explained  in  the  audit 
report . 
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of  the  Comptroller  General  of  the  United  States  Pamphlet 
2000-00110,  1972  (33:121-125). 


APPENDIX  D:  STRUCTURED  INTERVIEW  FORMAT 


Please  take  about  20  minutes  to  complete  the  following 
questions.  All  questions  relate  to  your  knowledge  as  the 
Internal  Control  Review  (ICR)  Monitor  at  your  base. 
•Answers  will  be  used  to  make  recommendations  to  the  Air 
Force  for  improvements  in  the  ICR  program.  Please  feel 
free  to  comment  on  any  question.  The  source  of  the 
answers  will  remain  confidential. 


PLEASE  CIRCLE  THE  NUMBER  BELOW  THE  ANSWER  YOU  CHOOSE 


1 .  What  has  been  the  general  reaction  of  the  personnel 
designated  to  conduct  ICRs? 

GOOD  FAIR  UNNECESSARY  UNKNOWN  OTHER 

PROGRAM  PROGRAM  PROGRAM  REACTION  (SPECIFY). 

1  2  3  4  _ 


2.  How  many  hours  per  year  has  your  office  spent,  on  the 
average,  training,  monitoring,  correcting,  completing 
designated  administrative  duties,  etc. ,  during  each  FY? 

If  data  unavailable,  please  provide  an  approximate  answer. 

FY83  _  FY84  _  FY85  _  FY86  _ 


3.  How  many  ICRs  have  been  completed  by  your  office  during 
each  Fiscal  Year  since  the  ICR  program  began? 

FY83  _  FY84  _  FY85  _  FY86  _ 


4.  How  many  of  the  above  ICRs  were  completed  by  the 
originally  scheduled  date? 

FY83  _  FY84  _  FY85  _  FY86  _ 


5.  Do  the  Functional  Area  Managers  (FAMs)  at  your 
installation  feel  that  Internal  Control  Reviews  (ICRs) 
are  their  responsibility? 


YES 

1 


NO 

2 


DON’T  KNOW 
3 
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6.  Do  any  of  the  Functional  Area  Managers  at  your 
installation  have  a  formal  plan  (e.g.  an  01,  squadron 
regulation  or  written  procedures)  for  completing  ICRs? 

YES  NO  DON’T  KNOW 

12  3 


7.  Does  your  office  have  a  formal  plan  (excluding  head¬ 
quarters,  MAJCOM  and  AF  directives)  for  completing  ICRs? 

YES  NO  DON’T  KNOW 

12  3 


8.  Does  your  office  have  a  formal  follow-up  program  for 
weaknesses  identified? 

YES  NO  DON’T  KNOW 

12  3 


9.  Are  there  sufficient  personnel  assigned  to  your  office 
to  accomplish  the  intent  of  internal  reviews,  per  AFR  170- 
22? 

YES  NO  DON’T  KNOW 
12  3 


10.  Do  Functional  Area  Managers  working  papers  provide  an 
adequate  audit  trail  to  pass  Air  Force  Audit  Agency  (AFAA) 
inspections? 

YES  NO  DON’T  KNOW 
12  3 


11.  Do  Functional  Area  Managers  have  complete  independence 
in  order  to  make  recommendations  for  improvements  or 
corrections  free  from  pressures  from  senior  management? 

YES  NO  DON’T  KNOW 

12  3 


12.  Do  you  believe  Cost  and  Management  Analysis  (ACC)  is 
the  appropriate  base-level  monitor  for  ICRs? 


YES 

1 


NO 

2 


DON’T  KNOW 
3 


13.  Do  you  think  "crossfeed"  items  from  other  bases  and 
commands  ICRs  could  be  beneficial  (maybe  using  anonymous 
sources  for  protection)? 

YES  NO  DON’T  KNOW 


.14.  Do  you  believe  that  internal  control  reviews  are  being 
properly  completed  at  your  base  with  no  "pencil  whipping"? 

YES  NO  DON’T  KNOW 

12  3 


15.  Are  internal  control  reviews  directed  toward 
appropriate  projects  rather  than  clerical  tasks? 

YES  NO  DON’T  KNOW 

12  3 


16.  Are  internal  control  review  findings  and 
recommendations  reported  to  the  commander  properly,  per  AFR 
170-22? 

YES  NO  DON’T  KNOW 

12  3 


17.  Does  the  Internal  Control  Review  Program  enjoy  the 
support  and  acceptance  of  the  commander? 

YES  NO  DON’T  KNOW 

12  3 


18.  Does  your  commander  become  involved  in  correction  of 
material  weaknesses  or  deficiencies? 

YES  NO  DON’T  KNOW 

12  3 


19.  Do  you  think  that  ICRs  could  be  incorporated  with 
another  currently  existing  program? 

YES  NO  DON’T  KNOW 

1  2  *  3 


If  yes,  please  answer  19a, b,c,  and  d. 

If  no  or  don’t  know,  please  go  to  question  #20. 


a.  With  which  program  would  you  incorporate  ICRs.?  (Air 
Force  Audit  Agency,  self-inspection,  etc.) 


b.  What  advantage  do  you  foresee  from  incorporating 
these  programs? 


c.  Do  you  think  that  this  incorporation  will  make  more 
manhours  available  for  other  ACC  duties? 

YES  NO  DON’T  KNOW 

12  3 


d.  If  yes,  how  many  manhours  each  ICR  cycle? 

0-15  16-30  31-45  46-60  61  or  more 

1  2  3  4  5 


20 .  How  many  months  have  you  been  the  ICR  Monitor? 

0-6  7-12  13-18  19-24  25-36  since  the  program 

123456  began  (FY83) 


21.  To  what  degree  do  your  Functional  Area  Managers 
believe  ICRs  help  in  controlling  fraud,  waste,  and  abuse 
of  government  resources? 

VERY  MUCH  SOMEWHAT  A  LITTLE  NOT  AT  ALL  OTHER  (SPECIFY) 
1  2  3  4  _ 


22.  To  what  degree  do  you  believe  ICRs  provide  insight 
to  the  commander  for  resource  control  and  management? 

VERY  MUCH  SOMEWHAT  A  LITTLE  NOT  AT  ALL  OTHER  (SPECIFY) 
1  2  3  4  _ 


23.  To  what  degree  do  you  feel  that  internal  controls 
are  a  necessary  management  tool? 

VERY  MUCH  SOMEWHAT  A  LITTLE  NOT  AT  ALL 
12  3  4 


24.  To  what  degree  do  you  agree  with  the  statement 
that  ICRs  are  "just  another  self -inspection"? 

VERY  MUCH  SOMEWHAT  A  LITTLE  NOT  AT  ALL 
12  3  4 


25.  Do  you  believe  including  internal  management 
control  responsibilities  in  performance  reports  would 
gain  management  support  for  the  program? 

VERY  MUCH  SOMEWHAT  A  LITTLE  NOT  AT  ALL 
12  3  4 


26.  Do  you  feel  that  ICRs  should  be  performed  by  a 
separate  office  reporting  directly  to  the  Comptroller 
in  order  to  provide  the  independence  required  in 
internal  audits  rather  than  the  functional  managers? 

VERY  MUCH  SOMEWHAT  A  LITTLE  NOT  AT  ALL 
12  3  4 


27.  Do  Functional  Area  Managers  request  your  assistance 
in  completing  ICRs? 

FREQUENTLY  SOMETIMES  RARELY  NOT  AT  ALL 
1  2  3  4 


28.  Do  Functional  Area  Managers  request  your  assistance 
in  gaining  the  commander’s  support  for  the  ICR  program? 

FREQUENTLY  SOMETIMES  RARELY  NOT  AT  ALL 
1  2  3  4 


29.  Do  they  request  training  in  ICR  procedures  from 
your  office? 

FREQUENTLY  SOMETIMES  RARELY  NOT  AT  ALL 
1  2  3  4 


30.  Do  personnel  in  your  office  act  as  consultants  for 
ICRs  to  other  functional  areas? 

FREQUENTLY  SOMETIMES  RARELY  NOT  AT  ALL 
1  2  3  4 


1 


31.  When  an  ICR  is  completed,  do  you  meet  with  the 
Functional  Area  Manager  performing  the  ICR  and  discuss 
the  findings  and  recommendations  before  forwarding  the 
report  to  your  headquarters? 

FREQUENTLY  SOMETIMES  RARELY  NOT  AT  ALL 

1  2  3  4 

32.  Do  you  periodically  spot-check  working  papers  of 
functional  area  managers  for  compliance  with  AFAA 
guidelines? 

FREQUENTLY  SOMETIMES  RARELY  NOT  AT  ALL 

1  2  3  4 


33.  To  what  degree  do  you  feel  you  received  guidance 
and  training  to  perform  duties  as  the  ICR  point-of-contact 
and  trainer  for  your  installation? 

EXTENSIVE  ADEQUATE  MINIMUM  NO  OTHER  (SPECIFY) 

TRAINING  TRAINING  TRAINING  TRAINING  _ 

1  2  3  4  _ 


34.  From  the  following  list,  circle  the  number 
corresponding  to  the  area/s  in  which  you  could  most 
benefit  from  additional  training: 


1. 

2. 

3. 

4. 


5. 

6. 
7. 
0. 


Auditing  procedures  and  standards 

Accounting  systems  review 

Automatic  Data  Processing  controls 

Knowledge  of  applicable  laws,  AF  and  command 

regulations/policies 

Resource  management 

Identifying  Air  Force  program  objectives 
Necessity  for  the  internal  control  program 
No  training  required 


35.  If  you  were  given  free  rein,  would  you  alter  the 
ICR  program? 


YES 

1 


NO 

2 


NO  OPINION 
3 


If  yes,  in  what  way(s)? 
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iAa  . 


36.  What  is  your  Major  Air  Command  or  Separate  Operating 
Agency? 

MAC  TAC  SAC  ATC  AFLC  EIS  SP  CMD  AU  OTHER  (SPECIFY) 


37.  What  is  your  grade/rank? 
a.  CIVILIAN 

GS-03  GS-05  GS-06  GS-07  GS-09  GS-10  GS-11  OTHER 

1234567  SPECIFY: _ 


b.  MILITARY 

E1-E4  E5-E6  E7-E8  E-9  01-02  03  04-05  OTHER 

1  2  3  4  5  6  7  SPECIFY:  _ 


38.  What  is  the  population  (military  and  civilian)  of 
the  installation  you  serve?  Circle  the  number 
corresponding  to  your  answer. 

1.  0-2,000 

2.  2,001-4,000 

3.  4,001-6,000 

4.  6,001-8,000 

5.  8,001-10,000 

6.  10,000-12,000 

7.  OVER  12,000  (SPECIFY  approximate  population) 


39.  In  your  view,  what  is  the  most  serious  impediment 
to  proper  completion  of  Internal  Control  Reviews? 


YES  NO  Do  you  wish  to  receive  copies  of  a  summary  of  the 
results  of  this  survey? 


Please  indicate  below  the  address  to  which  the 
summarized  results  should  be  mailed: 


If  you  have  any  questions  or  would  like  to  discuss  the 
survey  subject  or  its  contents,  please  call  me,  Captain 
Donna  Fry,  at  Autovon  785-4437  (AFIT/LSG). 


Thank  you  for  your  assistance. 
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